2006e1552aeeb659d856c0a01e5843e75eebeeadb583c27f61ca9291835c7186

Analysis

max time kernel
142s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/01/2024, 11:55

Target

$PLUGINSDIR/aobygkb.dll
Size

161KB
MD5

524d55604cb8d1d2c5fd1467a68eb98a
SHA1

d298f8c4b8e2b8000c1538d5c3761896ea028ca6
SHA256

850531a6f992fe1060815d994f9f368ad2bcddb3bf77d68319b155f4d144adec
SHA512

7571f9d3b0d529ebf6c4a3c1ad532208ec6adb070c7246e2fcfe0237ea41600a8f7914edaef1797bd144cb2885bd493cac7f9973ae16df532593a5a1b462e863
SSDEEP

1536:G97DJ+sSDf5obf2Nsu08hIT2QinOmx8Iy0vlM188XSvGsobLTbE2jgY+Kcows8ji:G9xZS4QOIK88CvGZEIz+QVdQgZGk

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2172	2408	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 2408	4256	rundll32.exe	85
PID 4256 wrote to memory of 2408	4256	rundll32.exe	85
PID 4256 wrote to memory of 2408	4256	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\aobygkb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\aobygkb.dll,#1
  2⤵
  PID:2408
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 600
    3⤵
    - Program crash
    PID:2172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2408 -ip 2408
1⤵
PID:2648