13549d818a858940e1f2cafe4617a0aaed08460f10a0a56d8400172933ed4dbb

Analysis

max time kernel
122s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/01/2024, 13:28

Target

$PLUGINSDIR/qdbwzkb.dll
Size

169KB
MD5

45db6b258f1313021f98a496a6dd1aa8
SHA1

166186901d12a55ec23991bba66c04f22d71a373
SHA256

37767fab1330bb1cb7bee47ffbf93b744b670530d4fad333bf57f532e083dafe
SHA512

f1a9eb694eaf4039de166955ad7028817d1d1a27b854d1506d44767cd5a97691300dfa228e38b8225a95ad9a07af04af93ccb5e84f1505bcde3ee1b3c681b3ee
SSDEEP

3072:G5Drd9pY2hSmazcl8aqTip+SwezZwmO1:WvD6Hm8aqeEyO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2120	2608	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 2608	2704	rundll32.exe	28
PID 2704 wrote to memory of 2608	2704	rundll32.exe	28
PID 2704 wrote to memory of 2608	2704	rundll32.exe	28
PID 2704 wrote to memory of 2608	2704	rundll32.exe	28
PID 2704 wrote to memory of 2608	2704	rundll32.exe	28
PID 2704 wrote to memory of 2608	2704	rundll32.exe	28
PID 2704 wrote to memory of 2608	2704	rundll32.exe	28
PID 2608 wrote to memory of 2120	2608	rundll32.exe	29
PID 2608 wrote to memory of 2120	2608	rundll32.exe	29
PID 2608 wrote to memory of 2120	2608	rundll32.exe	29
PID 2608 wrote to memory of 2120	2608	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\qdbwzkb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\qdbwzkb.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2608
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2608 -s 224
    3⤵
    - Program crash
    PID:2120