15ba5ecfbaf496bbdeb392cf9f20a9ce48ffa8ba51ec3723b17e0eb3c1e75c80

Analysis

max time kernel
129s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 00:49

Target

$PLUGINSDIR/ggh.dll
Size

121KB
MD5

fcbc742ac61f5c96dcd770f000f267dd
SHA1

ce091056e48bf8721239ed85255b4b8b1546c1ff
SHA256

e99801d5552138c067fe86977a9e5c6270eaada568094d1237776d8031c339a0
SHA512

404e2f621c4b3ff48171e249ee730532d62a8467cbd00cc4c0383682fd7979d049d31c07179f2c3066d60e97423375dac54c7781172fde0c6441e22f1c6c8330
SSDEEP

1536:eiLaFhGNjQi086qvWRb4bGVE5IlQvIWSDJWfP4heUyUnpBFeLpBRRjMn:eVMNjuqq6tvIkfwfyAFeLpBRRjMn

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3060 4892 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3060	4892	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3572 wrote to memory of 4892	3572	rundll32.exe	rundll32.exe
PID 3572 wrote to memory of 4892	3572	rundll32.exe	rundll32.exe
PID 3572 wrote to memory of 4892	3572	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ggh.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3572

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ggh.dll,#1
2⤵
PID:4892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 600
3⤵
- Program crash
PID:3060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4892 -ip 4892
1⤵
PID:2900