df82eb852e747c09c4f345ef2726bd4b0f1f262be3a2527401250ff9597343fe

Analysis

max time kernel
55s
max time network
49s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28/04/2024, 01:49

Target

$PLUGINSDIR/ngz.dll
Size

125KB
MD5

1dca01412e8bef71651216a3231e0d5f
SHA1

94ad7b7582b7609364c6986f0b880bdd6b3cdc12
SHA256

6319d5341868ce224bbe0c370fbc40db6e94d41dac63aab35ddce06a584611e6
SHA512

17369282387096e6196ee8851f5704a213761b6ffc2a7b3dcb8a956839a75c3579cf3237619c11ca9a59b77c866095337930566703cb1b34b4842dd5200e92c5
SSDEEP

1536:FbeXAFfcRpuya6j6/knTW2E9tp54Z8G6MEmfJzha1FSR8r4Zvn0BaOJvDkpPJXFt:71Ixj6FaFLfTEz4ZePkpPDuDuXX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2124	4756	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 4756	1832	rundll32.exe	83
PID 1832 wrote to memory of 4756	1832	rundll32.exe	83
PID 1832 wrote to memory of 4756	1832	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ngz.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ngz.dll,#1
  2⤵
  PID:4756
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 600
    3⤵
    - Program crash
    PID:2124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4756 -ip 4756
1⤵
PID:4512