231d10a8bc5ccb4e9a8c0175d6fc18e6848def14b5bcf04f46267d07f859a70a

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/04/2024, 22:13

Target

$PLUGINSDIR/hjvddpc.dll
Size

170KB
MD5

e8982cb5fd39819d921f6d84c8ee616c
SHA1

86be7e793c3cced2567af712d3cf66072fb6bb9c
SHA256

bab76e608c0776bb8258f2d8eb54ca7af02ebeca86881923a9e49ee9728d46c3
SHA512

23a8f2a75bb0349d23a891bd5fd90590f17994c57dc6877ca80a380512254baa07055c64ac367b00a95a50c45b969c1e4d1c004c8cbce36b94ef99d7b167124b
SSDEEP

3072:GfHLx5QO4e6gUeTuADpRn9ffrZ4+Uw3ztqac+t:yL8Q5Rfr2mJc+t

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2792	2264	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 2264	1364	rundll32.exe	28
PID 1364 wrote to memory of 2264	1364	rundll32.exe	28
PID 1364 wrote to memory of 2264	1364	rundll32.exe	28
PID 1364 wrote to memory of 2264	1364	rundll32.exe	28
PID 1364 wrote to memory of 2264	1364	rundll32.exe	28
PID 1364 wrote to memory of 2264	1364	rundll32.exe	28
PID 1364 wrote to memory of 2264	1364	rundll32.exe	28
PID 2264 wrote to memory of 2792	2264	rundll32.exe	29
PID 2264 wrote to memory of 2792	2264	rundll32.exe	29
PID 2264 wrote to memory of 2792	2264	rundll32.exe	29
PID 2264 wrote to memory of 2792	2264	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\hjvddpc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\hjvddpc.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2264
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2264 -s 220
    3⤵
    - Program crash
    PID:2792