12b7dfddd5856b364d61d1bb58939cd5b461e2cca28de864c8a98fbacca36517

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08-05-2024 19:42

Target

$PLUGINSDIR/alziwxl.dll
Size

169KB
MD5

0108d9b53f0c4cda97c9abacfd1bdfb1
SHA1

47e0b4cf375e469c570d15d0e8616172bac7d6aa
SHA256

ab63fedf56c3b6fe833c733ad3570a820acc956023f23196501d9c6af0fb7e4e
SHA512

fa6ea4929b8890f9115bba3261afad2b7fb6de10f9fd02e43e37614af2211ddc4a383fae0a670d7d4b5caed1759b066420fe43bf362ddd130cec27f698d4aa9d
SSDEEP

3072:GNSOtETW6pSRaDc18aa6iW+ewezQhGKchj:uSOyKTx8aaSwAKch

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3004	2900	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2900	2872	rundll32.exe	28
PID 2872 wrote to memory of 2900	2872	rundll32.exe	28
PID 2872 wrote to memory of 2900	2872	rundll32.exe	28
PID 2872 wrote to memory of 2900	2872	rundll32.exe	28
PID 2872 wrote to memory of 2900	2872	rundll32.exe	28
PID 2872 wrote to memory of 2900	2872	rundll32.exe	28
PID 2872 wrote to memory of 2900	2872	rundll32.exe	28
PID 2900 wrote to memory of 3004	2900	rundll32.exe	29
PID 2900 wrote to memory of 3004	2900	rundll32.exe	29
PID 2900 wrote to memory of 3004	2900	rundll32.exe	29
PID 2900 wrote to memory of 3004	2900	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\alziwxl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\alziwxl.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2900
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 224
    3⤵
    - Program crash
    PID:3004