12d13fa5af83a903bb2bb107c3d7e366c13f466eec45cd28736ed466be20da91

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
13-05-2024 12:46

Target

$PLUGINSDIR/dnjzh.dll
Size

125KB
MD5

7d7518d98e68eebbb02ee06a931fd0c6
SHA1

73a1c22beb0381aa241a4542df29d20a9da5e033
SHA256

6fd1735c87fd55624f93a5141710324ba6c23788c8804ce387592a6599fe7f14
SHA512

bb33af0a4b0f21fb13112cdd6880575c5ff7b19b67ec6db74f7c558a7666f8aa34864650313a4e5f56afb239da0d7e1a6c9e6c1d789907aa2c31e930e7103117
SSDEEP

3072:A5AHaDHVM+UgAP74ucqr2spP0waDx9Ow+:gGCVM/cut2sxCDx0w+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2612	2140	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 2140	1384	rundll32.exe	28
PID 1384 wrote to memory of 2140	1384	rundll32.exe	28
PID 1384 wrote to memory of 2140	1384	rundll32.exe	28
PID 1384 wrote to memory of 2140	1384	rundll32.exe	28
PID 1384 wrote to memory of 2140	1384	rundll32.exe	28
PID 1384 wrote to memory of 2140	1384	rundll32.exe	28
PID 1384 wrote to memory of 2140	1384	rundll32.exe	28
PID 2140 wrote to memory of 2612	2140	rundll32.exe	29
PID 2140 wrote to memory of 2612	2140	rundll32.exe	29
PID 2140 wrote to memory of 2612	2140	rundll32.exe	29
PID 2140 wrote to memory of 2612	2140	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\dnjzh.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\dnjzh.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2140
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 220
    3⤵
    - Program crash
    PID:2612