aabb19e261642e0b8d3bb1705a22032c96a3cf660047d86b3b8b304507c5cc6b

Analysis

max time kernel
66s
max time network
57s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28/04/2024, 03:36

Target

$PLUGINSDIR/kgpkxuri.dll
Size

107KB
MD5

e7c71fc0c4c4bdb007ba43ef32ee5ca5
SHA1

f2e8ac46d1b89ac16433969275796c78e13dd966
SHA256

2c0adc321ef831fec70b45cc1dce2ee417dc4e783d8607d08a10ff5025221b72
SHA512

b5e6ac8897c1efd0d9551612ed87f344f4d27a4535e7647127686cc3c57f6d2861e240f1761ddf853b42aad7b18e6f7e764cbcb4993bdb30937f1ce4a2f7f331
SSDEEP

1536:L1dr19yxY+eyrCpVF6kR5BZwyB45xppdWMYHTp2W4u+PSOuQgN:L1dr1I+yr9kFhqxWYW4ulBQg

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2180	3828	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 3828	2404	rundll32.exe	83
PID 2404 wrote to memory of 3828	2404	rundll32.exe	83
PID 2404 wrote to memory of 3828	2404	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\kgpkxuri.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\kgpkxuri.dll,#1
  2⤵
  PID:3828
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3828 -s 600
    3⤵
    - Program crash
    PID:2180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3828 -ip 3828
1⤵
PID:1112