1111b6c0549732eeea9845ed57c1e98f2bf6a6890bbd7e93e403a2251f9c191f

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 21:19

Target

$PLUGINSDIR/keygf.dll
Size

152KB
MD5

6ebdc0ab6bb0614c3a4bf8b6895330cc
SHA1

070967f02d287c596923514bf7d4a92fa435200c
SHA256

3e0cfb986e3a078cbd5696192f73b8dd47842511bb92eef1f7753621dfd1f3e2
SHA512

08eeac8528cf38b1c6003c1b7fc05fa237d42733d23ee93864bdc661fa6f779dad3d290a39a4675511c499780299e798c0a0656f586e636de3a2a4b431d012d7
SSDEEP

3072:GCOFODlkA1BfNUwFQ6926Jo+OG/8ssyKJ5:qFmNQ69joLGBm

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1564	1908	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 1908	2084	rundll32.exe	28
PID 2084 wrote to memory of 1908	2084	rundll32.exe	28
PID 2084 wrote to memory of 1908	2084	rundll32.exe	28
PID 2084 wrote to memory of 1908	2084	rundll32.exe	28
PID 2084 wrote to memory of 1908	2084	rundll32.exe	28
PID 2084 wrote to memory of 1908	2084	rundll32.exe	28
PID 2084 wrote to memory of 1908	2084	rundll32.exe	28
PID 1908 wrote to memory of 1564	1908	rundll32.exe	29
PID 1908 wrote to memory of 1564	1908	rundll32.exe	29
PID 1908 wrote to memory of 1564	1908	rundll32.exe	29
PID 1908 wrote to memory of 1564	1908	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\keygf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\keygf.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1908
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 220
    3⤵
    - Program crash
    PID:1564