20293f2776633514809eaa36fbce8b15df345318d138810dc3c152bc2f6359ed

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 06:39

Target
$PLUGINSDIR/kmxoeuy.dll
Size 170KB
Sample240613-hemp6ssaml
SHA256 30a89499e7e11968a6cd0fbd40e9b50d10fb8d66a0715aaec651a552039c702f
MD5 15633cb17a79403bd79062ddb5e8a027
SHA1 bccb2e48d09ccd74b729b346ab69e00eacb6bb3d
SHA512 643855e40317f601e507ecb6b6793187e52cb77b20d81b61208d156a8841171dd7cf2d1bc59bbaceab8a143cdad18677dd672886ef372e6add9282fc742bba08
SSDEEP 3072:GU5H/7GWh0TUmwiTTLy2Q689+xw2zfMSUj:z5HzGFDTLy2Q/7eZU
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3060	2440	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 2440	2144	rundll32.exe	28
PID 2144 wrote to memory of 2440	2144	rundll32.exe	28
PID 2144 wrote to memory of 2440	2144	rundll32.exe	28
PID 2144 wrote to memory of 2440	2144	rundll32.exe	28
PID 2144 wrote to memory of 2440	2144	rundll32.exe	28
PID 2144 wrote to memory of 2440	2144	rundll32.exe	28
PID 2144 wrote to memory of 2440	2144	rundll32.exe	28
PID 2440 wrote to memory of 3060	2440	rundll32.exe	29
PID 2440 wrote to memory of 3060	2440	rundll32.exe	29
PID 2440 wrote to memory of 3060	2440	rundll32.exe	29
PID 2440 wrote to memory of 3060	2440	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\kmxoeuy.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\kmxoeuy.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2440
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 220
    3⤵
    - Program crash
    PID:3060