12dcdca2d579b4d88c68b19276e929a7e5d39404f65389ee283ca803c19d1e3d

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
14-06-2024 17:43

Target

$PLUGINSDIR/sxmrlgj.dll
Size

166KB
MD5

63aec3d027eaf600c099230059014443
SHA1

e3b04bea02fb1cb63d75b5650932fee6f72bd558
SHA256

b42f2557cc3fdb7d5052c644ac6edb75115969fb0c76298fba1d21164d50ae73
SHA512

c1eac98d15ce834f1b05bc30b8e9ac5d52e533a2b721565bbd68470f1f248c59cdd61816a18e4d5af7cfea888ef0eda2bd1d52cada3feed4db130bbec5751319
SSDEEP

3072:GS3PeISryDuqKrj/eAniN2sMOdeBZs+Ap9s+YkW6evX:l3GISJWwiNdeB6yk/sX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2084	2068	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 2068	2452	rundll32.exe	28
PID 2452 wrote to memory of 2068	2452	rundll32.exe	28
PID 2452 wrote to memory of 2068	2452	rundll32.exe	28
PID 2452 wrote to memory of 2068	2452	rundll32.exe	28
PID 2452 wrote to memory of 2068	2452	rundll32.exe	28
PID 2452 wrote to memory of 2068	2452	rundll32.exe	28
PID 2452 wrote to memory of 2068	2452	rundll32.exe	28
PID 2068 wrote to memory of 2084	2068	rundll32.exe	29
PID 2068 wrote to memory of 2084	2068	rundll32.exe	29
PID 2068 wrote to memory of 2084	2068	rundll32.exe	29
PID 2068 wrote to memory of 2084	2068	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\sxmrlgj.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\sxmrlgj.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2068
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 220
    3⤵
    - Program crash
    PID:2084