414732dc0bd40e26a86abf7c3813c992b3e05e8865140d39b889ed13f4e1f9e6

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 14:21

Target

$PLUGINSDIR/ldgwskp.dll
Size

166KB
MD5

47df2ea5a06037a528eb46a5f72e2f0f
SHA1

0231d8e638ba6a612f9b35093766531062fe9cf5
SHA256

0178c82e785601a376fbb6989040b4b1e2238fc632c31ac18390bbc6fdb92622
SHA512

341d8e3fc3785ad195e69e0730b48dcafb4a2488bf7e8a404d8fa99fc913c23408173bf8f2b61abdc8073bcc6fc09b2eaad1ba181d198e866c60b945bd674777
SSDEEP

3072:GLQNezJoj8Fiqa4U/Kqvl5stMqdUpte9+qq9spYza6:oQNezCYFiUalCdUpt6aO6

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2196	2820	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2820	2060	rundll32.exe	28
PID 2060 wrote to memory of 2820	2060	rundll32.exe	28
PID 2060 wrote to memory of 2820	2060	rundll32.exe	28
PID 2060 wrote to memory of 2820	2060	rundll32.exe	28
PID 2060 wrote to memory of 2820	2060	rundll32.exe	28
PID 2060 wrote to memory of 2820	2060	rundll32.exe	28
PID 2060 wrote to memory of 2820	2060	rundll32.exe	28
PID 2820 wrote to memory of 2196	2820	rundll32.exe	29
PID 2820 wrote to memory of 2196	2820	rundll32.exe	29
PID 2820 wrote to memory of 2196	2820	rundll32.exe	29
PID 2820 wrote to memory of 2196	2820	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ldgwskp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ldgwskp.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 220
    3⤵
    - Program crash
    PID:2196