12dc1ff3298f4512458a0a2017333af43edaf64eb4c714f17ea9f30cf19bc2a2

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 21:40

Target

$PLUGINSDIR/qgiqemy.dll
Size

166KB
MD5

74550509a1c1e57e5d6d29dec03a9c1b
SHA1

2dae29485a19eec66ced686aa1afe930f763739b
SHA256

0cd21772df76df7faf8e3991c90031f9ef4bd82f3a746416161ab882bdc9064c
SHA512

36ef4a15242d4aed82eb36cc2ae6c9705dd36ab60950fdcbca3b8522bd893e81c62675ecb8742b81714535d1af5017831d1b1a85fdd5527bbb990d5fa1714b19
SSDEEP

3072:GN3PpISryDuqKlj/eshiN2sMOdm9P+QK9sMS6E1:63BISJk6iNdmFeTE1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1744	2312	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 2312	2032	rundll32.exe	28
PID 2032 wrote to memory of 2312	2032	rundll32.exe	28
PID 2032 wrote to memory of 2312	2032	rundll32.exe	28
PID 2032 wrote to memory of 2312	2032	rundll32.exe	28
PID 2032 wrote to memory of 2312	2032	rundll32.exe	28
PID 2032 wrote to memory of 2312	2032	rundll32.exe	28
PID 2032 wrote to memory of 2312	2032	rundll32.exe	28
PID 2312 wrote to memory of 1744	2312	rundll32.exe	29
PID 2312 wrote to memory of 1744	2312	rundll32.exe	29
PID 2312 wrote to memory of 1744	2312	rundll32.exe	29
PID 2312 wrote to memory of 1744	2312	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\qgiqemy.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\qgiqemy.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2312
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 220
    3⤵
    - Program crash
    PID:1744