047bafcff705a8a3fe3ceafd93117911a15554c70c4a580e7bc758affbe86675

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 02:14

Target

$PLUGINSDIR/hnppw.dll
Size

125KB
MD5

3c5734d72fe78fd6720d4d7f5dec353f
SHA1

1e2710c102070be7be8acd72cf6f57f732734f1b
SHA256

66f553456dcf9bfcf6424e5704d3cf10b388eda28bc6ff0b31b2cd9a1a2c487f
SHA512

9f6880a4ce781d9513c87e9d47693a43fecb836143c604d7a8fc7895bc6bbf20da2b0bdb4527c159c6afdcb628ebf2d98adde62130f7e0dcf80d304a51e8f422
SSDEEP

3072:q5AHaDHVM+UgAP74ucqr2spP0wsDx9Ow+:OGCVM/cut2sxUDx0w+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2204	2192	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2192	1992	rundll32.exe	28
PID 1992 wrote to memory of 2192	1992	rundll32.exe	28
PID 1992 wrote to memory of 2192	1992	rundll32.exe	28
PID 1992 wrote to memory of 2192	1992	rundll32.exe	28
PID 1992 wrote to memory of 2192	1992	rundll32.exe	28
PID 1992 wrote to memory of 2192	1992	rundll32.exe	28
PID 1992 wrote to memory of 2192	1992	rundll32.exe	28
PID 2192 wrote to memory of 2204	2192	rundll32.exe	29
PID 2192 wrote to memory of 2204	2192	rundll32.exe	29
PID 2192 wrote to memory of 2204	2192	rundll32.exe	29
PID 2192 wrote to memory of 2204	2192	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\hnppw.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\hnppw.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2192
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 220
    3⤵
    - Program crash
    PID:2204