1022acac29b441e673ba4f6340a3ab13babbb3b0652f1cad311226a410cbee6d

Analysis

max time kernel
118s
max time network
132s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 23:49

Target

$PLUGINSDIR/ygmdagm.dll
Size

169KB
MD5

06676f166129828f767f5e78ad906f5e
SHA1

092e4b1b806615ce9e8cad35dac799896f78d6c1
SHA256

7f640a152c3c8c4c049eab64650e0053468f9f9b7c9d2a0d3379bce39e03d270
SHA512

c54354545229544af8ee7cdf98dfbacc59129fffd81e893a2da1668f08049599e4b381d0449fd0cc727f0424c375692e6563d94d2c54e01f0444c87a8936d803
SSDEEP

3072:GZ9Am6kdzGVvTapWybUPn0cRfXn+gNwYdzx2J7lS1:y9BKVMrcR/mYGlM

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1468	1316	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1156 wrote to memory of 1316	1156	rundll32.exe	28
PID 1156 wrote to memory of 1316	1156	rundll32.exe	28
PID 1156 wrote to memory of 1316	1156	rundll32.exe	28
PID 1156 wrote to memory of 1316	1156	rundll32.exe	28
PID 1156 wrote to memory of 1316	1156	rundll32.exe	28
PID 1156 wrote to memory of 1316	1156	rundll32.exe	28
PID 1156 wrote to memory of 1316	1156	rundll32.exe	28
PID 1316 wrote to memory of 1468	1316	rundll32.exe	29
PID 1316 wrote to memory of 1468	1316	rundll32.exe	29
PID 1316 wrote to memory of 1468	1316	rundll32.exe	29
PID 1316 wrote to memory of 1468	1316	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ygmdagm.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ygmdagm.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1316
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1316 -s 224
    3⤵
    - Program crash
    PID:1468