23c1dc3a44c1a2598ea526c4458218a66930a415dffaecb818bed5b8fd6adbf9

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 01:58

Target

$PLUGINSDIR/dgsefthm.dll
Size

107KB
MD5

2fcd55bd34ec2a94e3354ad2b38c3d27
SHA1

d4a38acaad64e2ee22312bc204bafb3be5640815
SHA256

1435afb1a98c7190ebff6a093fd1851dd05916dae6e6f6981600fbb0bcd27d56
SHA512

8cf6c3b248124610015ec65eec2d9271618e6e0ae0ca18446bb62bd74bc21d9f370d66d3d0832f685d398057adce1de511fde2691715a025bd08d7ca319aeb2e
SSDEEP

1536:bSJKrVdw3Rl6CoVRrsRwmycygd5AppdWMYHTp214wyDVrSUtRN:bSJKrVKhl6Ns16rxWY14dYUtR

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3012	4616	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 4616	2816	rundll32.exe	83
PID 2816 wrote to memory of 4616	2816	rundll32.exe	83
PID 2816 wrote to memory of 4616	2816	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\dgsefthm.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\dgsefthm.dll,#1
  2⤵
  PID:4616
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 600
    3⤵
    - Program crash
    PID:3012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4616 -ip 4616
1⤵
PID:1168