203921cc416314abd18473044b8a27913835bd923b324bae0086c7401f9627b0

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
05/05/2024, 02:25

Target

$PLUGINSDIR/cfcnylv.dll
Size

153KB
MD5

01bce109d8a462e2ae84ec617287867c
SHA1

717f97fb5e21ae916ab26b08a65d66e51b0bc92c
SHA256

d5f93c4eb052d9063499f0d62f794b19dcd966287e91c118117b44106a815df6
SHA512

2d1946eee1cb61c60467fa34c5a4fbfeff49e509e19ddf40510fe43263cf441bd53b6adafa1a0591ad9c15af7b388b41a242168747bc39f2275313465e500a48
SSDEEP

3072:G3Z3VTVBYqvus53WhuXniHp8/JKv+oG//sRVOxHQ:qZ3Rl3yHp8Mv9GRxHQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3024	2936	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2936	2924	rundll32.exe	28
PID 2924 wrote to memory of 2936	2924	rundll32.exe	28
PID 2924 wrote to memory of 2936	2924	rundll32.exe	28
PID 2924 wrote to memory of 2936	2924	rundll32.exe	28
PID 2924 wrote to memory of 2936	2924	rundll32.exe	28
PID 2924 wrote to memory of 2936	2924	rundll32.exe	28
PID 2924 wrote to memory of 2936	2924	rundll32.exe	28
PID 2936 wrote to memory of 3024	2936	rundll32.exe	29
PID 2936 wrote to memory of 3024	2936	rundll32.exe	29
PID 2936 wrote to memory of 3024	2936	rundll32.exe	29
PID 2936 wrote to memory of 3024	2936	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\cfcnylv.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\cfcnylv.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2936
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 220
    3⤵
    - Program crash
    PID:3024