014d0ece0d472eaea73698d634308303ddb9f227f39d339a66416c3cb744d2c1

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
02-04-2024 22:37

Target

$PLUGINSDIR/nawgsdqut.dll
Size

104KB
MD5

d4233fefc9328cc30b0ef014beb2f51b
SHA1

302180a5edb1fd653d7884bb60172e6edfbbeac4
SHA256

1827a3002964434b0acff1359241948e334148d3413312cfea326cae8f269758
SHA512

b3e19c83e631b6a8b8b0d00ab14af811519765b737f1497f27e8c3a8c3328038967dbb6095671e4095af48d6355b5f13cec20c38ef2dfb14cc2ae8e9482de4af
SSDEEP

1536:XlGfGAPqPOicsu0WpmS89PdDeSGTzIfTw83qVlIHyaaEil3Wkly9ncobUfs+ulZ6:1GfGAIOqXSKS13nKixlyrquv

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2372 1460 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2372	1460	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2348 wrote to memory of 1460	2348	rundll32.exe	rundll32.exe
PID 2348 wrote to memory of 1460	2348	rundll32.exe	rundll32.exe
PID 2348 wrote to memory of 1460	2348	rundll32.exe	rundll32.exe
PID 2348 wrote to memory of 1460	2348	rundll32.exe	rundll32.exe
PID 2348 wrote to memory of 1460	2348	rundll32.exe	rundll32.exe
PID 2348 wrote to memory of 1460	2348	rundll32.exe	rundll32.exe
PID 2348 wrote to memory of 1460	2348	rundll32.exe	rundll32.exe
PID 1460 wrote to memory of 2372	1460	rundll32.exe	WerFault.exe
PID 1460 wrote to memory of 2372	1460	rundll32.exe	WerFault.exe
PID 1460 wrote to memory of 2372	1460	rundll32.exe	WerFault.exe
PID 1460 wrote to memory of 2372	1460	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nawgsdqut.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2348

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nawgsdqut.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1460 -s 268
3⤵
- Program crash
PID:2372