13817334b617b2f91aa1b8f7bf46b39952669fa433212bb470e80ba50a71540a

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 10:41

Target

$PLUGINSDIR/dnjzh.dll
Size

125KB
MD5

7d7518d98e68eebbb02ee06a931fd0c6
SHA1

73a1c22beb0381aa241a4542df29d20a9da5e033
SHA256

6fd1735c87fd55624f93a5141710324ba6c23788c8804ce387592a6599fe7f14
SHA512

bb33af0a4b0f21fb13112cdd6880575c5ff7b19b67ec6db74f7c558a7666f8aa34864650313a4e5f56afb239da0d7e1a6c9e6c1d789907aa2c31e930e7103117
SSDEEP

3072:A5AHaDHVM+UgAP74ucqr2spP0waDx9Ow+:gGCVM/cut2sxCDx0w+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2040	3000	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 3000	2992	rundll32.exe	28
PID 2992 wrote to memory of 3000	2992	rundll32.exe	28
PID 2992 wrote to memory of 3000	2992	rundll32.exe	28
PID 2992 wrote to memory of 3000	2992	rundll32.exe	28
PID 2992 wrote to memory of 3000	2992	rundll32.exe	28
PID 2992 wrote to memory of 3000	2992	rundll32.exe	28
PID 2992 wrote to memory of 3000	2992	rundll32.exe	28
PID 3000 wrote to memory of 2040	3000	rundll32.exe	29
PID 3000 wrote to memory of 2040	3000	rundll32.exe	29
PID 3000 wrote to memory of 2040	3000	rundll32.exe	29
PID 3000 wrote to memory of 2040	3000	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\dnjzh.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\dnjzh.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 220
    3⤵
    - Program crash
    PID:2040