ed5e8ff7e2e5e830e2265ab6d76a5889a656444e157237426c0504a21a517471

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/04/2024, 18:05

Target
$PLUGINSDIR/sogqjgayoly.dll
Size 35KB
Sample240405-wpn8msaf2w
SHA256 416c75dbb19ed40f62e8d02219faa4ef0c1568e1507b7d58fc0090871534dd48
MD5 3486630808a1ce5c9754676814e058bd
SHA1 be6b220984f8554e4f98d6d4f9512d13525f5572
SHA512 3d9556ada0379eae4a70878317a609349f49c44f256e4c3cf4249e17cee4728eab476c6f30525dffc53422e17541534ed126a9059ec8b0dd055e380b4ec10452
SSDEEP 768:KYjdXnijLBTXd2JWMW3JNyXVciwrBus0+a7:hJnGLBTN2PVXVciGu5+a
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1012	3900	WerFault.exe	85

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3140 wrote to memory of 3900	3140	rundll32.exe	85
PID 3140 wrote to memory of 3900	3140	rundll32.exe	85
PID 3140 wrote to memory of 3900	3140	rundll32.exe	85
PID 3900 wrote to memory of 4144	3900	rundll32.exe	89
PID 3900 wrote to memory of 4144	3900	rundll32.exe	89
PID 3900 wrote to memory of 4144	3900	rundll32.exe	89
PID 3900 wrote to memory of 4144	3900	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\sogqjgayoly.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3140
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\sogqjgayoly.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3900
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\sogqjgayoly.dll,#1
    3⤵
    PID:4144
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3900 -s 692
    3⤵
    - Program crash
    PID:1012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3900 -ip 3900
1⤵
PID:1112

memory/3900-0-0x0000000010000000-0x000000001000C000-memory.dmp

Download