24124b15fa8f079623e2dc34b14da6ca3d5912af69022c5c00cbb2602c3b838a

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 19:07

Target

$PLUGINSDIR/khvbx.dll
Size

152KB
MD5

7662739a6ee08008f23c9768e5450422
SHA1

187698d22490b46c4cb26fa00f8d4fad9c47bc24
SHA256

5c7b456d830097dcdcf3486ba31ed6fc475447a9df903fe37350a195428da5b4
SHA512

195943f40485535689ae8aaea2a5999e3a8d0fe00736b62a922ecfd645579ff66fce8efb678c337e5dcd6e1dd788c693507fafd73514daf13bec5f92835e06d4
SSDEEP

3072:G99t6F0XY0MpiO5YvJq7rVC2+FG/3s0I2/N:4DM0Kp73MG7/N

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2800 1952 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2800	1952	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2484 wrote to memory of 1952	2484	rundll32.exe	rundll32.exe
PID 2484 wrote to memory of 1952	2484	rundll32.exe	rundll32.exe
PID 2484 wrote to memory of 1952	2484	rundll32.exe	rundll32.exe
PID 2484 wrote to memory of 1952	2484	rundll32.exe	rundll32.exe
PID 2484 wrote to memory of 1952	2484	rundll32.exe	rundll32.exe
PID 2484 wrote to memory of 1952	2484	rundll32.exe	rundll32.exe
PID 2484 wrote to memory of 1952	2484	rundll32.exe	rundll32.exe
PID 1952 wrote to memory of 2800	1952	rundll32.exe	WerFault.exe
PID 1952 wrote to memory of 2800	1952	rundll32.exe	WerFault.exe
PID 1952 wrote to memory of 2800	1952	rundll32.exe	WerFault.exe
PID 1952 wrote to memory of 2800	1952	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\khvbx.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\khvbx.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1952
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1952 -s 220
    3⤵
    - Program crash
    PID:2800