15806331386f446a7507203bd9e00e7d74ae339ddf6a6db249833b62a8a10c10

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 13:11

Target

$PLUGINSDIR/czifqiz.dll
Size

161KB
MD5

fe65cdd18d4c567b6a3c12214c55f4e7
SHA1

5312c385a6267b17ae7c314e1fd8863ed94a6744
SHA256

e189e3ef2008c32f528f2d6a7c463f6e8de238ad0e550dadde580515f5a56063
SHA512

bc826255605c6ec151b36222e5b2c0e1bd06e224e9342e984050f8681cb1ab624f58d86acee424195c1a369e912234eeec2bc9ad4bf04ce815dc4e973023dd76
SSDEEP

3072:GFTZSxgOf6M8CvGLKBdz+tVdQbwJOZJcO:qcjfvGLKHdy8Jc

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1964	756	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 756	1720	rundll32.exe	28
PID 1720 wrote to memory of 756	1720	rundll32.exe	28
PID 1720 wrote to memory of 756	1720	rundll32.exe	28
PID 1720 wrote to memory of 756	1720	rundll32.exe	28
PID 1720 wrote to memory of 756	1720	rundll32.exe	28
PID 1720 wrote to memory of 756	1720	rundll32.exe	28
PID 1720 wrote to memory of 756	1720	rundll32.exe	28
PID 756 wrote to memory of 1964	756	rundll32.exe	29
PID 756 wrote to memory of 1964	756	rundll32.exe	29
PID 756 wrote to memory of 1964	756	rundll32.exe	29
PID 756 wrote to memory of 1964	756	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\czifqiz.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\czifqiz.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:756
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 224
    3⤵
    - Program crash
    PID:1964