15ba5ecfbaf496bbdeb392cf9f20a9ce48ffa8ba51ec3723b17e0eb3c1e75c80

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 00:49

Target

$PLUGINSDIR/ggh.dll
Size

121KB
MD5

fcbc742ac61f5c96dcd770f000f267dd
SHA1

ce091056e48bf8721239ed85255b4b8b1546c1ff
SHA256

e99801d5552138c067fe86977a9e5c6270eaada568094d1237776d8031c339a0
SHA512

404e2f621c4b3ff48171e249ee730532d62a8467cbd00cc4c0383682fd7979d049d31c07179f2c3066d60e97423375dac54c7781172fde0c6441e22f1c6c8330
SSDEEP

1536:eiLaFhGNjQi086qvWRb4bGVE5IlQvIWSDJWfP4heUyUnpBFeLpBRRjMn:eVMNjuqq6tvIkfwfyAFeLpBRRjMn

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2156 2260 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2156	2260	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2248 wrote to memory of 2260	2248	rundll32.exe	rundll32.exe
PID 2248 wrote to memory of 2260	2248	rundll32.exe	rundll32.exe
PID 2248 wrote to memory of 2260	2248	rundll32.exe	rundll32.exe
PID 2248 wrote to memory of 2260	2248	rundll32.exe	rundll32.exe
PID 2248 wrote to memory of 2260	2248	rundll32.exe	rundll32.exe
PID 2248 wrote to memory of 2260	2248	rundll32.exe	rundll32.exe
PID 2248 wrote to memory of 2260	2248	rundll32.exe	rundll32.exe
PID 2260 wrote to memory of 2156	2260	rundll32.exe	WerFault.exe
PID 2260 wrote to memory of 2156	2260	rundll32.exe	WerFault.exe
PID 2260 wrote to memory of 2156	2260	rundll32.exe	WerFault.exe
PID 2260 wrote to memory of 2156	2260	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ggh.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2248

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ggh.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 220
3⤵
- Program crash
PID:2156