1584be15308169c82dad516ae19d0e367f595e008ab083a7714c50cfb88e2c73

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/06/2024, 14:34

Target

$PLUGINSDIR/cppahhz.dll
Size

153KB
MD5

256a4fd5061e042b52c698808fa161cc
SHA1

4ab8bf6233e87efe2bc7cdce908a894854ca523c
SHA256

3c857fb04ef9e3ecef14cd2c6fc8e19d2b44fe699d0dc9ef1d467731a61cb916
SHA512

6bd24d68bad8763b4e10ab6596dd23f609319d5aa6472f408ba6ccd2bab61b7c1f514337e11963ef076d65cc4b25d0914390a3aecbd1c80b4f785a984ff8eea0
SSDEEP

1536:GS119M9GRwN24gkykW/EEZsu0IXYKFhijQZ1Dyfs7/K0Xg8XmiXSPRzh8CAdwJ+P:Gg1m+ycrd/bXg83XETAGm+AG/XsVi6M

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2252	2248	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2248	2220	rundll32.exe	28
PID 2220 wrote to memory of 2248	2220	rundll32.exe	28
PID 2220 wrote to memory of 2248	2220	rundll32.exe	28
PID 2220 wrote to memory of 2248	2220	rundll32.exe	28
PID 2220 wrote to memory of 2248	2220	rundll32.exe	28
PID 2220 wrote to memory of 2248	2220	rundll32.exe	28
PID 2220 wrote to memory of 2248	2220	rundll32.exe	28
PID 2248 wrote to memory of 2252	2248	rundll32.exe	29
PID 2248 wrote to memory of 2252	2248	rundll32.exe	29
PID 2248 wrote to memory of 2252	2248	rundll32.exe	29
PID 2248 wrote to memory of 2252	2248	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\cppahhz.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\cppahhz.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2248
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2248 -s 220
    3⤵
    - Program crash
    PID:2252