7af496b9b0be5083b3e99fb7d9172511f4de9bc61f6fc33c5379fc5e8db9e729

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 18:22

Target

$PLUGINSDIR/hwicqlt.dll
Size

125KB
MD5

40a2f2afdc75fae2df6c98046b8213a5
SHA1

4353ca892730c82bb993b8f33b9bf74d3c2e3c48
SHA256

4ebf3abdf86dcd21736e1e3f918145e0b185cf7153205dd86ade90bdf43c2eeb
SHA512

447bfab9f40c009ef6d5563a5de74d9b600843ffa71e9d428bb7f329163612fdccef7c7e7739b017de5059af6b14bf93bab4cbc6d7828a5c89e23dc96131aa1b
SSDEEP

3072:6vgDAOSB+nF1WaJtK9LY1RO1j16V1+ry:6vg32aKuRsaQry

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2544	2392	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 2392	2216	rundll32.exe	28
PID 2216 wrote to memory of 2392	2216	rundll32.exe	28
PID 2216 wrote to memory of 2392	2216	rundll32.exe	28
PID 2216 wrote to memory of 2392	2216	rundll32.exe	28
PID 2216 wrote to memory of 2392	2216	rundll32.exe	28
PID 2216 wrote to memory of 2392	2216	rundll32.exe	28
PID 2216 wrote to memory of 2392	2216	rundll32.exe	28
PID 2392 wrote to memory of 2544	2392	rundll32.exe	29
PID 2392 wrote to memory of 2544	2392	rundll32.exe	29
PID 2392 wrote to memory of 2544	2392	rundll32.exe	29
PID 2392 wrote to memory of 2544	2392	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\hwicqlt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\hwicqlt.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2392
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 220
    3⤵
    - Program crash
    PID:2544