209d00cf16ed8b48f92c8fce04455f2bdc1838425e2e20aadd7b75cb8a675cae

Analysis

max time kernel
139s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 15:22

Target

$PLUGINSDIR/guxvvlj.dll
Size

153KB
MD5

b9f10ee282b950087315493642302880
SHA1

035b2a99ae258ed7f69cf8de20e01c60a471a23e
SHA256

43c7531670ec72563ffa3bb36a7058988ccc8f07feb766bd6b120748203062dd
SHA512

c8d4d0f81be6f74100f16fee0979aeb09f9b7a84720466b903cf67b6db3ee4bba76161908a2386976572c646cdbc8fcf73d376b9d43391382377d3e82d5127e2
SSDEEP

1536:GOF9ei7ByCo4wqiUGPU0Zsu0IXfBUhiOz2FDvf8W/j4A8Xmna/YBUosCC+X+TcHq:G1X+sJAa5/0A8Kagzv+WG/nsg6Zi

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3460	5096	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3748 wrote to memory of 5096	3748	rundll32.exe	85
PID 3748 wrote to memory of 5096	3748	rundll32.exe	85
PID 3748 wrote to memory of 5096	3748	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\guxvvlj.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3748
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\guxvvlj.dll,#1
  2⤵
  PID:5096
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5096 -s 600
    3⤵
    - Program crash
    PID:3460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5096 -ip 5096
1⤵
PID:4292