c67452f65d0c7187312499a53670b1e82895518b487328026b2957ee77a274a1

Analysis

max time kernel
137s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 20:31

Target

$PLUGINSDIR/qzoxzhphgp.dll
Size

1002KB
MD5

4bb0f84995346c5f73a3dfbd8d8cf26b
SHA1

17c011f920bd74c37c86488832fd95270429478b
SHA256

5f9e2a5ef08cd02bcac2d2045f7b149b11f4daed2a253bbcc38cdfe8b1850600
SHA512

bf9e042405df6af8eb54c78ee8fd0ac00b997171bf0a88ffb36588d2f9247667b9c03a73fc97b7e58e3ed8cf5c37e0fbe4f2033c1ebe78b91121c92adecf1369
SSDEEP

24576:MvaVnVw6hrM8zxLcaHr2JGjoEYnJLUTOhXUbVWXjCnr:s8/w87URJcCEUXEr

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4060 4528 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4060	4528	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 332 wrote to memory of 4528	332	rundll32.exe	rundll32.exe
PID 332 wrote to memory of 4528	332	rundll32.exe	rundll32.exe
PID 332 wrote to memory of 4528	332	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\qzoxzhphgp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:332

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\qzoxzhphgp.dll,#1
2⤵
PID:4528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4528 -s 1408
3⤵
- Program crash
PID:4060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4528 -ip 4528
1⤵
PID:4248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1340 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:2876

memory/4528-0-0x0000000003410000-0x00000000034F5000-memory.dmp

Filesize
916KB

Download
memory/4528-1-0x0000000003600000-0x000000000380C000-memory.dmp

Filesize
2.0MB

Download
memory/4528-6-0x0000000003600000-0x000000000380C000-memory.dmp

Filesize
2.0MB

Download
memory/4528-7-0x0000000003600000-0x000000000380C000-memory.dmp

Filesize
2.0MB

Download
memory/4528-8-0x0000000003600000-0x000000000380C000-memory.dmp

Filesize
2.0MB

Download
memory/4528-9-0x0000000000400000-0x0000000000500000-memory.dmp

Filesize
1024KB

Download
memory/4528-10-0x0000000003600000-0x000000000380C000-memory.dmp

Filesize
2.0MB

Download
memory/4528-12-0x0000000003410000-0x00000000034F5000-memory.dmp

Filesize
916KB

Download