df5039197d98afa27ede1f1a8de46052de7ae716fd87d68b949b87649014b366

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-03-2024 16:14

Target

$PLUGINSDIR/czqp.dll
Size

24KB
MD5

d4e1b723e7687c5c404bc81cfce6a5ec
SHA1

dd6d741f860eb6ee59aab7455d895c2e0f394a55
SHA256

ae58d3fdef96fa5a1525a7ced314231b4883ed796fe8a42958d5bf24b21fa64d
SHA512

359c32988a018748b157fa93f38c6ef92b28508cbf86ca129218848679b009fa630d31198ce85d9c31e8815c24aeb8be428c1e882cf67936df8a85bd542d8a3c
SSDEEP

384:7reSw0JDTRCNzQL+LWJYjnZjHGTjA4CbuP9Wuud9QQh8xf6LPvtTbMqg:DwwRCBnWJIntmTKBuaQFOPFTbM

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2492 2232 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2492	2232	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1864 wrote to memory of 2232	1864	rundll32.exe	rundll32.exe
PID 1864 wrote to memory of 2232	1864	rundll32.exe	rundll32.exe
PID 1864 wrote to memory of 2232	1864	rundll32.exe	rundll32.exe
PID 1864 wrote to memory of 2232	1864	rundll32.exe	rundll32.exe
PID 1864 wrote to memory of 2232	1864	rundll32.exe	rundll32.exe
PID 1864 wrote to memory of 2232	1864	rundll32.exe	rundll32.exe
PID 1864 wrote to memory of 2232	1864	rundll32.exe	rundll32.exe
PID 2232 wrote to memory of 2492	2232	rundll32.exe	WerFault.exe
PID 2232 wrote to memory of 2492	2232	rundll32.exe	WerFault.exe
PID 2232 wrote to memory of 2492	2232	rundll32.exe	WerFault.exe
PID 2232 wrote to memory of 2492	2232	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\czqp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1864

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\czqp.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 312
3⤵
- Program crash
PID:2492