04ee29e2d323f4c6f18361e54f17b15135daf98ecfc3bed09a74b91f8f0ee2f5

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 16:48

Target

$PLUGINSDIR/sylrhaz.dll
Size

161KB
MD5

8bc4405aab9e9e2e8e17aceb0a273772
SHA1

533762514c6d40e79a5cd604f310fd5f7151070c
SHA256

2b47725c2c625bb22e96229572b8fdfd3b87fe8642a98a13b80f9fd10da6bdb5
SHA512

238b45df7df079112fd38771e9fb391236c7a5b96756123d6b66c4964f0a9d639227cecbef6812f6cd22a9415bc72219aa8b6926ab06451da497b1ff4cc84878
SSDEEP

1536:GDlDJ+sSDf5obf2Nsu08hIT2QinOmx8If0vlM188XSvGLp0bLTbE2jgY+PCcowsc:GDTZS4QOBK88CvGLKEIz+QVdQY0ZccH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1916	1712	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 620 wrote to memory of 1712	620	rundll32.exe	28
PID 620 wrote to memory of 1712	620	rundll32.exe	28
PID 620 wrote to memory of 1712	620	rundll32.exe	28
PID 620 wrote to memory of 1712	620	rundll32.exe	28
PID 620 wrote to memory of 1712	620	rundll32.exe	28
PID 620 wrote to memory of 1712	620	rundll32.exe	28
PID 620 wrote to memory of 1712	620	rundll32.exe	28
PID 1712 wrote to memory of 1916	1712	rundll32.exe	29
PID 1712 wrote to memory of 1916	1712	rundll32.exe	29
PID 1712 wrote to memory of 1916	1712	rundll32.exe	29
PID 1712 wrote to memory of 1916	1712	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\sylrhaz.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:620
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\sylrhaz.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 220
    3⤵
    - Program crash
    PID:1916