04ee29e2d323f4c6f18361e54f17b15135daf98ecfc3bed09a74b91f8f0ee2f5

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 16:48

Target

$PLUGINSDIR/sylrhaz.dll
Size

161KB
MD5

8bc4405aab9e9e2e8e17aceb0a273772
SHA1

533762514c6d40e79a5cd604f310fd5f7151070c
SHA256

2b47725c2c625bb22e96229572b8fdfd3b87fe8642a98a13b80f9fd10da6bdb5
SHA512

238b45df7df079112fd38771e9fb391236c7a5b96756123d6b66c4964f0a9d639227cecbef6812f6cd22a9415bc72219aa8b6926ab06451da497b1ff4cc84878
SSDEEP

1536:GDlDJ+sSDf5obf2Nsu08hIT2QinOmx8If0vlM188XSvGLp0bLTbE2jgY+PCcowsc:GDTZS4QOBK88CvGLKEIz+QVdQY0ZccH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3672	1400	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 1400	1968	rundll32.exe	81
PID 1968 wrote to memory of 1400	1968	rundll32.exe	81
PID 1968 wrote to memory of 1400	1968	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\sylrhaz.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\sylrhaz.dll,#1
  2⤵
  PID:1400
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 600
    3⤵
    - Program crash
    PID:3672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1400 -ip 1400
1⤵
PID:4808