3ce6061c6ba624ee1cfef7e08127aa8e1287c413ea15a0ce174f830920a9582d

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 04:35

Target
$PLUGINSDIR/blowfish.dll
Size 22KB
Sample240614-e7sv4sygrp
SHA256 053b4487d22aacf8274bab448ae1d665fe7926102197b47bfba6c7ed5493b3ae
MD5 5afd4a9b7e69e7c6e312b2ce4040394a
SHA1 fbd07adb3f02f866dc3a327a86b0f319d4a94502
SHA512 f78efe9d1fa7d2ffc731d5f878f81e4dcbfaf0c561fdfbf4c133ba2ce1366c95c4672d67cae6a8bd8fcc7d04861a9da389d98361055ac46fc9793828d9776511
SSDEEP 384:yTxz0Cv0hqd+1TjQmd9YWrSUEc//////OD5hF92IJpJgLa0MpoYfAz6S:jCvsqdS3QGBREc//////Q53NgLa1ub
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1952	2084	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 2084	1612	rundll32.exe	28
PID 1612 wrote to memory of 2084	1612	rundll32.exe	28
PID 1612 wrote to memory of 2084	1612	rundll32.exe	28
PID 1612 wrote to memory of 2084	1612	rundll32.exe	28
PID 1612 wrote to memory of 2084	1612	rundll32.exe	28
PID 1612 wrote to memory of 2084	1612	rundll32.exe	28
PID 1612 wrote to memory of 2084	1612	rundll32.exe	28
PID 2084 wrote to memory of 1952	2084	rundll32.exe	29
PID 2084 wrote to memory of 1952	2084	rundll32.exe	29
PID 2084 wrote to memory of 1952	2084	rundll32.exe	29
PID 2084 wrote to memory of 1952	2084	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\blowfish.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\blowfish.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2084
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 224
    3⤵
    - Program crash
    PID:1952

memory/2084-0-0x0000000000170000-0x000000000017C000-memory.dmp

Download