153487fd3148af2e5ec81e6f03254558252125a1214beff2dd1455217d6816e0

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 00:01

Target

$PLUGINSDIR/qgiqemy.dll
Size

166KB
MD5

74550509a1c1e57e5d6d29dec03a9c1b
SHA1

2dae29485a19eec66ced686aa1afe930f763739b
SHA256

0cd21772df76df7faf8e3991c90031f9ef4bd82f3a746416161ab882bdc9064c
SHA512

36ef4a15242d4aed82eb36cc2ae6c9705dd36ab60950fdcbca3b8522bd893e81c62675ecb8742b81714535d1af5017831d1b1a85fdd5527bbb990d5fa1714b19
SSDEEP

3072:GN3PpISryDuqKlj/eshiN2sMOdm9P+QK9sMS6E1:63BISJk6iNdmFeTE1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2092	2076	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 2076	1752	rundll32.exe	28
PID 1752 wrote to memory of 2076	1752	rundll32.exe	28
PID 1752 wrote to memory of 2076	1752	rundll32.exe	28
PID 1752 wrote to memory of 2076	1752	rundll32.exe	28
PID 1752 wrote to memory of 2076	1752	rundll32.exe	28
PID 1752 wrote to memory of 2076	1752	rundll32.exe	28
PID 1752 wrote to memory of 2076	1752	rundll32.exe	28
PID 2076 wrote to memory of 2092	2076	rundll32.exe	29
PID 2076 wrote to memory of 2092	2076	rundll32.exe	29
PID 2076 wrote to memory of 2092	2076	rundll32.exe	29
PID 2076 wrote to memory of 2092	2076	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\qgiqemy.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\qgiqemy.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2076
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2076 -s 220
    3⤵
    - Program crash
    PID:2092