c67452f65d0c7187312499a53670b1e82895518b487328026b2957ee77a274a1

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 20:31

Target

$PLUGINSDIR/qzoxzhphgp.dll
Size

1002KB
MD5

4bb0f84995346c5f73a3dfbd8d8cf26b
SHA1

17c011f920bd74c37c86488832fd95270429478b
SHA256

5f9e2a5ef08cd02bcac2d2045f7b149b11f4daed2a253bbcc38cdfe8b1850600
SHA512

bf9e042405df6af8eb54c78ee8fd0ac00b997171bf0a88ffb36588d2f9247667b9c03a73fc97b7e58e3ed8cf5c37e0fbe4f2033c1ebe78b91121c92adecf1369
SSDEEP

24576:MvaVnVw6hrM8zxLcaHr2JGjoEYnJLUTOhXUbVWXjCnr:s8/w87URJcCEUXEr

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2000 2072 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2000	2072	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2004 wrote to memory of 2072	2004	rundll32.exe	rundll32.exe
PID 2004 wrote to memory of 2072	2004	rundll32.exe	rundll32.exe
PID 2004 wrote to memory of 2072	2004	rundll32.exe	rundll32.exe
PID 2004 wrote to memory of 2072	2004	rundll32.exe	rundll32.exe
PID 2004 wrote to memory of 2072	2004	rundll32.exe	rundll32.exe
PID 2004 wrote to memory of 2072	2004	rundll32.exe	rundll32.exe
PID 2004 wrote to memory of 2072	2004	rundll32.exe	rundll32.exe
PID 2072 wrote to memory of 2000	2072	rundll32.exe	WerFault.exe
PID 2072 wrote to memory of 2000	2072	rundll32.exe	WerFault.exe
PID 2072 wrote to memory of 2000	2072	rundll32.exe	WerFault.exe
PID 2072 wrote to memory of 2000	2072	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\qzoxzhphgp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2004

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\qzoxzhphgp.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 796
3⤵
- Program crash
PID:2000

memory/2072-0-0x0000000001DC0000-0x0000000001EC0000-memory.dmp

Filesize
1024KB

Download
memory/2072-1-0x0000000002E00000-0x0000000002EE5000-memory.dmp

Filesize
916KB

Download
memory/2072-5-0x0000000002FF0000-0x00000000031FC000-memory.dmp

Filesize
2.0MB

Download
memory/2072-2-0x0000000002FF0000-0x00000000031FC000-memory.dmp

Filesize
2.0MB

Download
memory/2072-7-0x0000000002FF0000-0x00000000031FC000-memory.dmp

Filesize
2.0MB

Download
memory/2072-8-0x0000000002FF0000-0x00000000031FC000-memory.dmp

Filesize
2.0MB

Download
memory/2072-9-0x0000000001DC0000-0x0000000001EC0000-memory.dmp

Filesize
1024KB

Download
memory/2072-11-0x0000000002E00000-0x0000000002EE5000-memory.dmp

Filesize
916KB

Download
memory/2072-12-0x0000000002FF0000-0x00000000031FC000-memory.dmp

Filesize
2.0MB

Download