149c26e5258f761658c3157b67db9ffb48b76df1c66febf6ec51cfb3e186f792

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 05:00

Target

$PLUGINSDIR/rjyyqfg.dll
Size

158KB
MD5

799c50bd1c2966ef98bf12062646c37f
SHA1

1acb3e6e7eb5d699c3265af3f42eb1f46efcad5c
SHA256

c396a227874eead9eefd81352917315f9c50de6db0a86e2e3ebd6a66efaef2a2
SHA512

b397b3a3e40a18db680ccd8b23e252cbcdd4d68bae9567d44192c98579c14553a272ae5240f231f448b93fea5f134096dbebba98a00e7685f3184d6c2ef0096d
SSDEEP

3072:TMvt6YatbMGdF/zwKAu30Q6+JWzY6jgUHb7d:TMUDdCO0VD9zb7

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1580	2172	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2172	2188	rundll32.exe	28
PID 2188 wrote to memory of 2172	2188	rundll32.exe	28
PID 2188 wrote to memory of 2172	2188	rundll32.exe	28
PID 2188 wrote to memory of 2172	2188	rundll32.exe	28
PID 2188 wrote to memory of 2172	2188	rundll32.exe	28
PID 2188 wrote to memory of 2172	2188	rundll32.exe	28
PID 2188 wrote to memory of 2172	2188	rundll32.exe	28
PID 2172 wrote to memory of 1580	2172	rundll32.exe	29
PID 2172 wrote to memory of 1580	2172	rundll32.exe	29
PID 2172 wrote to memory of 1580	2172	rundll32.exe	29
PID 2172 wrote to memory of 1580	2172	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\rjyyqfg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\rjyyqfg.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2172
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 220
    3⤵
    - Program crash
    PID:1580