224b71ec0d41758f1a83d8cb988bed9a39c547263fc51bf78bb1657972bf5c76

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27-04-2024 10:30

Target

$PLUGINSDIR/egvkdgg.dll
Size

170KB
MD5

14c8b2573e0b4e10a5aadc1949430c4b
SHA1

65e411d36481324896bc708880623ca1f04d1ef2
SHA256

169147eaec31b8b694e2e1cb7c391c294b788ad7c3b0c51a696326bb3d81189f
SHA512

9365ae078a5056c5dc425faa26f4c5edaea9bfc4413a9017dab2576a53b2fbb508f885bc0ff0380e49801ec8223d03cdac06dfc2a5fb7fafb87ae92e14cc8bca
SSDEEP

3072:G/Hrx5gOoG6gEOTdlTZxn9oHC81+0wG9zPac8:qr84Z2H/mGMc8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1036	2200	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2200	2356	rundll32.exe	28
PID 2356 wrote to memory of 2200	2356	rundll32.exe	28
PID 2356 wrote to memory of 2200	2356	rundll32.exe	28
PID 2356 wrote to memory of 2200	2356	rundll32.exe	28
PID 2356 wrote to memory of 2200	2356	rundll32.exe	28
PID 2356 wrote to memory of 2200	2356	rundll32.exe	28
PID 2356 wrote to memory of 2200	2356	rundll32.exe	28
PID 2200 wrote to memory of 1036	2200	rundll32.exe	29
PID 2200 wrote to memory of 1036	2200	rundll32.exe	29
PID 2200 wrote to memory of 1036	2200	rundll32.exe	29
PID 2200 wrote to memory of 1036	2200	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\egvkdgg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\egvkdgg.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 220
    3⤵
    - Program crash
    PID:1036