df82eb852e747c09c4f345ef2726bd4b0f1f262be3a2527401250ff9597343fe

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/04/2024, 01:49

Target

$PLUGINSDIR/ngz.dll
Size

125KB
MD5

1dca01412e8bef71651216a3231e0d5f
SHA1

94ad7b7582b7609364c6986f0b880bdd6b3cdc12
SHA256

6319d5341868ce224bbe0c370fbc40db6e94d41dac63aab35ddce06a584611e6
SHA512

17369282387096e6196ee8851f5704a213761b6ffc2a7b3dcb8a956839a75c3579cf3237619c11ca9a59b77c866095337930566703cb1b34b4842dd5200e92c5
SSDEEP

1536:FbeXAFfcRpuya6j6/knTW2E9tp54Z8G6MEmfJzha1FSR8r4Zvn0BaOJvDkpPJXFt:71Ixj6FaFLfTEz4ZePkpPDuDuXX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1668	880	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 880	1032	rundll32.exe	28
PID 1032 wrote to memory of 880	1032	rundll32.exe	28
PID 1032 wrote to memory of 880	1032	rundll32.exe	28
PID 1032 wrote to memory of 880	1032	rundll32.exe	28
PID 1032 wrote to memory of 880	1032	rundll32.exe	28
PID 1032 wrote to memory of 880	1032	rundll32.exe	28
PID 1032 wrote to memory of 880	1032	rundll32.exe	28
PID 880 wrote to memory of 1668	880	rundll32.exe	29
PID 880 wrote to memory of 1668	880	rundll32.exe	29
PID 880 wrote to memory of 1668	880	rundll32.exe	29
PID 880 wrote to memory of 1668	880	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ngz.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ngz.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:880
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 880 -s 220
    3⤵
    - Program crash
    PID:1668