aabb19e261642e0b8d3bb1705a22032c96a3cf660047d86b3b8b304507c5cc6b

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-04-2024 03:36

Target

$PLUGINSDIR/kgpkxuri.dll
Size

107KB
MD5

e7c71fc0c4c4bdb007ba43ef32ee5ca5
SHA1

f2e8ac46d1b89ac16433969275796c78e13dd966
SHA256

2c0adc321ef831fec70b45cc1dce2ee417dc4e783d8607d08a10ff5025221b72
SHA512

b5e6ac8897c1efd0d9551612ed87f344f4d27a4535e7647127686cc3c57f6d2861e240f1761ddf853b42aad7b18e6f7e764cbcb4993bdb30937f1ce4a2f7f331
SSDEEP

1536:L1dr19yxY+eyrCpVF6kR5BZwyB45xppdWMYHTp2W4u+PSOuQgN:L1dr1I+yr9kFhqxWYW4ulBQg

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1960	1924	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 1924	2960	rundll32.exe	28
PID 2960 wrote to memory of 1924	2960	rundll32.exe	28
PID 2960 wrote to memory of 1924	2960	rundll32.exe	28
PID 2960 wrote to memory of 1924	2960	rundll32.exe	28
PID 2960 wrote to memory of 1924	2960	rundll32.exe	28
PID 2960 wrote to memory of 1924	2960	rundll32.exe	28
PID 2960 wrote to memory of 1924	2960	rundll32.exe	28
PID 1924 wrote to memory of 1960	1924	rundll32.exe	29
PID 1924 wrote to memory of 1960	1924	rundll32.exe	29
PID 1924 wrote to memory of 1960	1924	rundll32.exe	29
PID 1924 wrote to memory of 1960	1924	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\kgpkxuri.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\kgpkxuri.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1924
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1924 -s 220
    3⤵
    - Program crash
    PID:1960