21ab9e6bfc63c6058a2efc0cda1d996caab0de41d6ceda874e0e24b10e94b451

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 23:36

Target

$PLUGINSDIR/evcqdwp.dll
Size

166KB
MD5

9f0a2b99a21e9f74ff5301683015eee5
SHA1

f737ccb077c227124e54736107fb120d257429ac
SHA256

4ddaf119fa946dd4c30d5e0a8a189fc52a2871dd930c35d09e9d2a03a0969a56
SHA512

ae657b93deef13b624498c4339e257c84c511b726c85275b35dddd635fd7ad884e81bc31545a7a64fe8ed615eac4ba44cd314e071b976097ce2b4488bf4f8ad8
SSDEEP

3072:GTh2gtEEADqaQs/SvvUhstM1dPmcNM+8q9szYTab:Yh2gWEA3AHUVdPmzaub

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1952	1728	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 1728	2388	rundll32.exe	28
PID 2388 wrote to memory of 1728	2388	rundll32.exe	28
PID 2388 wrote to memory of 1728	2388	rundll32.exe	28
PID 2388 wrote to memory of 1728	2388	rundll32.exe	28
PID 2388 wrote to memory of 1728	2388	rundll32.exe	28
PID 2388 wrote to memory of 1728	2388	rundll32.exe	28
PID 2388 wrote to memory of 1728	2388	rundll32.exe	28
PID 1728 wrote to memory of 1952	1728	rundll32.exe	29
PID 1728 wrote to memory of 1952	1728	rundll32.exe	29
PID 1728 wrote to memory of 1952	1728	rundll32.exe	29
PID 1728 wrote to memory of 1952	1728	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\evcqdwp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\evcqdwp.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 220
    3⤵
    - Program crash
    PID:1952