10b9879f3c5ff7f70d8fc4249da79de329cc69e0b7ccc0e97c4761e9723d9821

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 07:28

Target

$PLUGINSDIR/ftwjyfv.dll
Size

166KB
MD5

d13c3039967951f8ae2606d6f083f173
SHA1

4d0a9dadd8642e95fadaca4447f30613abd84be3
SHA256

b63d3b340fdea8034d4532f1b7548db7d1ef0cd8491b325c009b92e5c734f518
SHA512

30ee1eaea297e5142fd87e3791d4907d2ec38bd155274078d301ca00a1449825d2d278415739dfa61b6bbb24a3b2c66ecfd1f4beb9c08dd851fad6dc39b7a138
SSDEEP

3072:GgL1v5gkoqa80/O2vqdstMzdtMMTOG+9q9sTY+aw:nL1vmkkAGq/dtMMN/nw

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2104	1696	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 1696	2164	rundll32.exe	28
PID 2164 wrote to memory of 1696	2164	rundll32.exe	28
PID 2164 wrote to memory of 1696	2164	rundll32.exe	28
PID 2164 wrote to memory of 1696	2164	rundll32.exe	28
PID 2164 wrote to memory of 1696	2164	rundll32.exe	28
PID 2164 wrote to memory of 1696	2164	rundll32.exe	28
PID 2164 wrote to memory of 1696	2164	rundll32.exe	28
PID 1696 wrote to memory of 2104	1696	rundll32.exe	29
PID 1696 wrote to memory of 2104	1696	rundll32.exe	29
PID 1696 wrote to memory of 2104	1696	rundll32.exe	29
PID 1696 wrote to memory of 2104	1696	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ftwjyfv.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ftwjyfv.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 224
    3⤵
    - Program crash
    PID:2104