135133ac77fc0b7a0710fa7901324b5e48245ba801a6c60436832f48f13b2091

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 23:57

Target

$PLUGINSDIR/fwenguj.dll
Size

153KB
MD5

fdb5c2696178e6ae8150b9c0fca44b5c
SHA1

39f25b26c5ea9842113d09fcff7ea76f1e9373af
SHA256

0bc4de5d215128070feee0681dd8e9352e8e782401109a92b4aa10e83308fc71
SHA512

549696a6c607110dac1f079cb6bda0b8252f0194a9cebf17752dedb8a064790f78ba4743db04f115a237a80548eb992c0eb7c9d178d4d8f413f3a5fd61b33593
SSDEEP

1536:GH/9+48IDIut4gSy5W/EgZsu0hsRK6hioZZ1D9PDI/JMXg8Xm1YRa12iTC/9+X+C:Gp/Ey3Xkr+/WXg8sYEyS++G/HsIy6b

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2328	2184	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 2184	836	rundll32.exe	28
PID 836 wrote to memory of 2184	836	rundll32.exe	28
PID 836 wrote to memory of 2184	836	rundll32.exe	28
PID 836 wrote to memory of 2184	836	rundll32.exe	28
PID 836 wrote to memory of 2184	836	rundll32.exe	28
PID 836 wrote to memory of 2184	836	rundll32.exe	28
PID 836 wrote to memory of 2184	836	rundll32.exe	28
PID 2184 wrote to memory of 2328	2184	rundll32.exe	29
PID 2184 wrote to memory of 2328	2184	rundll32.exe	29
PID 2184 wrote to memory of 2328	2184	rundll32.exe	29
PID 2184 wrote to memory of 2328	2184	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\fwenguj.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:836
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\fwenguj.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2184
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 220
    3⤵
    - Program crash
    PID:2328