b87ecdb8035fa8b5ce87570d757265182a9f49122a02e77dc7f414816cf4b511

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/04/2024, 11:31

Target
$PLUGINSDIR/mahyiit.dll
Size 105KB
Sample240401-nmt24sdg26
SHA256 0eaec60342b2074da968f010e592ad52c8b7dbfd72759b97f999f0eb88861136
MD5 b5d0f9fbb3df9a1a42b479fdd334417c
SHA1 f0780dbafbdb20235c97a28cc0ad8e1abc1547f3
SHA512 3bd39726feb5b0b946e6b29c17a12ba044bf2d0e5374c217527542a6a6f09f65e3944007d0427936178e5c485bede8631caa5738d0be50ac291759fcdd4ec26f
SSDEEP 1536:wmFgGAZxpEuLPsu0NR7mNzUK2q8fIrzcYyKkRrIAHaqsWnvf3WklE9ncobUfsirl:FFgGAaus+eyvKjxlErGrz
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2920	2352	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2352	2208	rundll32.exe	28
PID 2208 wrote to memory of 2352	2208	rundll32.exe	28
PID 2208 wrote to memory of 2352	2208	rundll32.exe	28
PID 2208 wrote to memory of 2352	2208	rundll32.exe	28
PID 2208 wrote to memory of 2352	2208	rundll32.exe	28
PID 2208 wrote to memory of 2352	2208	rundll32.exe	28
PID 2208 wrote to memory of 2352	2208	rundll32.exe	28
PID 2352 wrote to memory of 2920	2352	rundll32.exe	29
PID 2352 wrote to memory of 2920	2352	rundll32.exe	29
PID 2352 wrote to memory of 2920	2352	rundll32.exe	29
PID 2352 wrote to memory of 2920	2352	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\mahyiit.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\mahyiit.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2352
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2352 -s 280
    3⤵
    - Program crash
    PID:2920