23c1dc3a44c1a2598ea526c4458218a66930a415dffaecb818bed5b8fd6adbf9

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 01:58

Target

$PLUGINSDIR/dgsefthm.dll
Size

107KB
MD5

2fcd55bd34ec2a94e3354ad2b38c3d27
SHA1

d4a38acaad64e2ee22312bc204bafb3be5640815
SHA256

1435afb1a98c7190ebff6a093fd1851dd05916dae6e6f6981600fbb0bcd27d56
SHA512

8cf6c3b248124610015ec65eec2d9271618e6e0ae0ca18446bb62bd74bc21d9f370d66d3d0832f685d398057adce1de511fde2691715a025bd08d7ca319aeb2e
SSDEEP

1536:bSJKrVdw3Rl6CoVRrsRwmycygd5AppdWMYHTp214wyDVrSUtRN:bSJKrVKhl6Ns16rxWY14dYUtR

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1928	2388	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 2388	1808	rundll32.exe	28
PID 1808 wrote to memory of 2388	1808	rundll32.exe	28
PID 1808 wrote to memory of 2388	1808	rundll32.exe	28
PID 1808 wrote to memory of 2388	1808	rundll32.exe	28
PID 1808 wrote to memory of 2388	1808	rundll32.exe	28
PID 1808 wrote to memory of 2388	1808	rundll32.exe	28
PID 1808 wrote to memory of 2388	1808	rundll32.exe	28
PID 2388 wrote to memory of 1928	2388	rundll32.exe	29
PID 2388 wrote to memory of 1928	2388	rundll32.exe	29
PID 2388 wrote to memory of 1928	2388	rundll32.exe	29
PID 2388 wrote to memory of 1928	2388	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\dgsefthm.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\dgsefthm.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2388
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 220
    3⤵
    - Program crash
    PID:1928