103af711e997eb80f91c58071ce769e67b149d4e8af821ec4df40f5bbb7ce278

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 11:26

Target

$PLUGINSDIR/sylrhaz.dll
Size

161KB
MD5

8bc4405aab9e9e2e8e17aceb0a273772
SHA1

533762514c6d40e79a5cd604f310fd5f7151070c
SHA256

2b47725c2c625bb22e96229572b8fdfd3b87fe8642a98a13b80f9fd10da6bdb5
SHA512

238b45df7df079112fd38771e9fb391236c7a5b96756123d6b66c4964f0a9d639227cecbef6812f6cd22a9415bc72219aa8b6926ab06451da497b1ff4cc84878
SSDEEP

1536:GDlDJ+sSDf5obf2Nsu08hIT2QinOmx8If0vlM188XSvGLp0bLTbE2jgY+PCcowsc:GDTZS4QOBK88CvGLKEIz+QVdQY0ZccH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2164	2412	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 2412	2604	rundll32.exe	28
PID 2604 wrote to memory of 2412	2604	rundll32.exe	28
PID 2604 wrote to memory of 2412	2604	rundll32.exe	28
PID 2604 wrote to memory of 2412	2604	rundll32.exe	28
PID 2604 wrote to memory of 2412	2604	rundll32.exe	28
PID 2604 wrote to memory of 2412	2604	rundll32.exe	28
PID 2604 wrote to memory of 2412	2604	rundll32.exe	28
PID 2412 wrote to memory of 2164	2412	rundll32.exe	29
PID 2412 wrote to memory of 2164	2412	rundll32.exe	29
PID 2412 wrote to memory of 2164	2412	rundll32.exe	29
PID 2412 wrote to memory of 2164	2412	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\sylrhaz.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\sylrhaz.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2412
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2412 -s 220
    3⤵
    - Program crash
    PID:2164