44b59fc0b14ce3cd13497367a3245f5508d115987a92e1bebd97207da95fc9f2

Analysis

max time kernel
118s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 01:47

Target

pugdogrun/GdiPlus.dll
Size

1.6MB
MD5

b5625560cda13a81d367b32e6f9fc4ac
SHA1

f6c2b5168bca5f6e6eb930f7688bb8b8634cb582
SHA256

377f8efb6b05f13a9b1a8c8a237c44cf4f6309b27c8913cc665cd1aa11a189df
SHA512

f5b6ae03d0f0eba8bc5e7b5f1f0fa06fffc6fd0421cf06a4a60ea1c45d5f76449f1a3cd24c9bfc54105398f76717987dd62953886cb1b348c4eba075e6c2f82f
SSDEEP

24576:2uV2jR8Jitgx1PnLq3+WJPS/kgDnnkYBS9ZhynO0WTOxi:2uMjOitOtLq5JDkHc9MnWH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1284	1920	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 1920	2156	rundll32.exe	28
PID 2156 wrote to memory of 1920	2156	rundll32.exe	28
PID 2156 wrote to memory of 1920	2156	rundll32.exe	28
PID 2156 wrote to memory of 1920	2156	rundll32.exe	28
PID 2156 wrote to memory of 1920	2156	rundll32.exe	28
PID 2156 wrote to memory of 1920	2156	rundll32.exe	28
PID 2156 wrote to memory of 1920	2156	rundll32.exe	28
PID 1920 wrote to memory of 1284	1920	rundll32.exe	29
PID 1920 wrote to memory of 1284	1920	rundll32.exe	29
PID 1920 wrote to memory of 1284	1920	rundll32.exe	29
PID 1920 wrote to memory of 1284	1920	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\pugdogrun\GdiPlus.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\pugdogrun\GdiPlus.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1920
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1920 -s 228
    3⤵
    - Program crash
    PID:1284