1d55c9d6edbd2a75e3202646ddd3649e3249ba8b43ff051299859a5edd258cf6

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
31/03/2024, 06:27

Target
$PLUGINSDIR/phzgia.dll
Size 42KB
Sample240331-g7rn6afb7y
SHA256 88430ee3f7acaae7ce13b9d5df10a8851df927767f3f660f13fdc9ca4edf106f
MD5 fadd6e52f774915df3d8ad879bd957d9
SHA1 89b91131d77380a6514d1aa609ff3f5187153133
SHA512 25f05f83a789556dd42a4f609c357aa8c40663673ea2a5beee02f88564c3c142b747481e714daaf578361d8940d93bc08ae6bd6a1c1582b285e1a4cd94566054
SSDEEP 768:IYjfeAOj7jaorohxhtyqFF66UaXS2yn1+AOjylWJ:IYjmAu7GDh6Z1+AOjyC
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2344	4588	WerFault.exe	86

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4004 wrote to memory of 4588	4004	rundll32.exe	86
PID 4004 wrote to memory of 4588	4004	rundll32.exe	86
PID 4004 wrote to memory of 4588	4004	rundll32.exe	86
PID 4588 wrote to memory of 4172	4588	rundll32.exe	90
PID 4588 wrote to memory of 4172	4588	rundll32.exe	90
PID 4588 wrote to memory of 4172	4588	rundll32.exe	90
PID 4588 wrote to memory of 4172	4588	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\phzgia.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\phzgia.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4588
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\phzgia.dll,#1
    3⤵
    PID:4172
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 692
    3⤵
    - Program crash
    PID:2344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4588 -ip 4588
1⤵
PID:4464

memory/4588-0-0x0000000010000000-0x000000001000D000-memory.dmp

Download