22047a945f05b46c4c8629074f9e57b94510f05e417209e8d9c9ec14cc095b45

Analysis

max time kernel
90s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/01/2024, 12:50

Target

$PLUGINSDIR/guivgig.dll
Size

161KB
MD5

4512019defa05ddabaf404bb9198c0d5
SHA1

11766c8aab95eab088817bc092668649be343081
SHA256

9d9098ab22edbe4a14e9f879a1e348c480752b49db07d3856874e5f3c53c86c5
SHA512

8d073a81c2314abce508664f1df2f2f3a6a1f88685ed0074832e78a3793da144d068ad82535d9c9008fa73a0fc44d8f9e7fb63ede0bc04fd05bdf0fa42802948
SSDEEP

1536:GNjkGDbcCR5vJuJa0/rzsu0aV+2eGilOQhQLqRLDMLuEXQvue4pLVSYTjgY+6coX:GNjfgCRimR0UquEAvuXjPz+gV9Q5ZAd

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
752	4892	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 4892	4880	rundll32.exe	89
PID 4880 wrote to memory of 4892	4880	rundll32.exe	89
PID 4880 wrote to memory of 4892	4880	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\guivgig.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\guivgig.dll,#1
  2⤵
  PID:4892
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 608
    3⤵
    - Program crash
    PID:752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4892 -ip 4892
1⤵
PID:960