53fb1511812b33448fb51c4a6a7f4095600f2d30251546466ab1d401191fa59a

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/04/2024, 00:23

Target
$PLUGINSDIR/cwehlkdexhf.dll
Size 28KB
Sample240403-apz49aab2x
SHA256 f70b1ff393e0aaf8c737ec09a41598d9e51fbdde8bb19a7051aecc8d0752c965
MD5 201dec4f5cfe9c448804d504da2b9f50
SHA1 4a565158eb3ee42694427374e11fc052a0bd3dad
SHA512 52771f45ca9d51fe84d125fcb741ea9485ffef8620c5bf7c4cf233f66540dc27e48bc1b83d7a16dfd2faaafa66903dd7504620721385ce106addbde15a1bac82
SSDEEP 768:B7pNn0kP7w1oJDO7uYZMPHyko/9QPQSV:BHwFcHG1OV
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2888	2736	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2736	2988	rundll32.exe	28
PID 2988 wrote to memory of 2736	2988	rundll32.exe	28
PID 2988 wrote to memory of 2736	2988	rundll32.exe	28
PID 2988 wrote to memory of 2736	2988	rundll32.exe	28
PID 2988 wrote to memory of 2736	2988	rundll32.exe	28
PID 2988 wrote to memory of 2736	2988	rundll32.exe	28
PID 2988 wrote to memory of 2736	2988	rundll32.exe	28
PID 2736 wrote to memory of 2888	2736	rundll32.exe	29
PID 2736 wrote to memory of 2888	2736	rundll32.exe	29
PID 2736 wrote to memory of 2888	2736	rundll32.exe	29
PID 2736 wrote to memory of 2888	2736	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\cwehlkdexhf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\cwehlkdexhf.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 264
    3⤵
    - Program crash
    PID:2888