209d00cf16ed8b48f92c8fce04455f2bdc1838425e2e20aadd7b75cb8a675cae

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-04-2024 15:22

Target

$PLUGINSDIR/guxvvlj.dll
Size

153KB
MD5

b9f10ee282b950087315493642302880
SHA1

035b2a99ae258ed7f69cf8de20e01c60a471a23e
SHA256

43c7531670ec72563ffa3bb36a7058988ccc8f07feb766bd6b120748203062dd
SHA512

c8d4d0f81be6f74100f16fee0979aeb09f9b7a84720466b903cf67b6db3ee4bba76161908a2386976572c646cdbc8fcf73d376b9d43391382377d3e82d5127e2
SSDEEP

1536:GOF9ei7ByCo4wqiUGPU0Zsu0IXfBUhiOz2FDvf8W/j4A8Xmna/YBUosCC+X+TcHq:G1X+sJAa5/0A8Kagzv+WG/nsg6Zi

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1680	2372	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 2372	2936	rundll32.exe	28
PID 2936 wrote to memory of 2372	2936	rundll32.exe	28
PID 2936 wrote to memory of 2372	2936	rundll32.exe	28
PID 2936 wrote to memory of 2372	2936	rundll32.exe	28
PID 2936 wrote to memory of 2372	2936	rundll32.exe	28
PID 2936 wrote to memory of 2372	2936	rundll32.exe	28
PID 2936 wrote to memory of 2372	2936	rundll32.exe	28
PID 2372 wrote to memory of 1680	2372	rundll32.exe	29
PID 2372 wrote to memory of 1680	2372	rundll32.exe	29
PID 2372 wrote to memory of 1680	2372	rundll32.exe	29
PID 2372 wrote to memory of 1680	2372	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\guxvvlj.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\guxvvlj.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2372
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 220
    3⤵
    - Program crash
    PID:1680