2008013715665f8eedc63838240c2d526e7f9437918c7227a2710449be52cde1

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
03/05/2024, 10:04

Target

$PLUGINSDIR/gggtoep.dll
Size

153KB
MD5

f618272fa8cefbf03a11c2b0fe4b5cbb
SHA1

a83c328353ad163ff31ea18e738605a10ff07b35
SHA256

842779e2ca72e93da4d7bf9a8491dc5270ed19404d7db77e1c0d26f056f2dddc
SHA512

94e75aab4861ee7f3c2eddc51cf86167c5dc32e220752a70e0d1c4b649cc744e5fb654bb2ecd057271667cc1564e477f64e62e92d912d959c0937941e975ee6d
SSDEEP

1536:GKV9k5q8rtp4gYykW/EUZsu0IXEKRhiXcZ1D2vsv/GUXg8XmWTODxPVsCaq+X+VZ:G7h+yesr9/vXg8LTszO+gG/fs736Y

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2952	2784	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2784	2916	rundll32.exe	28
PID 2916 wrote to memory of 2784	2916	rundll32.exe	28
PID 2916 wrote to memory of 2784	2916	rundll32.exe	28
PID 2916 wrote to memory of 2784	2916	rundll32.exe	28
PID 2916 wrote to memory of 2784	2916	rundll32.exe	28
PID 2916 wrote to memory of 2784	2916	rundll32.exe	28
PID 2916 wrote to memory of 2784	2916	rundll32.exe	28
PID 2784 wrote to memory of 2952	2784	rundll32.exe	29
PID 2784 wrote to memory of 2952	2784	rundll32.exe	29
PID 2784 wrote to memory of 2952	2784	rundll32.exe	29
PID 2784 wrote to memory of 2952	2784	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\gggtoep.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\gggtoep.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 220
    3⤵
    - Program crash
    PID:2952