10db97906966767ac56af42d32da193d7e0ae5ec77472de0d038a49f9971d3e7

Analysis

max time kernel
90s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
29/01/2024, 06:53

Target

$PLUGINSDIR/psyzabw.dll
Size

161KB
MD5

d9f4f90f9626af7f7356d54e4c03b576
SHA1

983cb93b2cba3c798d4daf62eafb7b7a0c91f176
SHA256

04773d4f03215c9557794207fc0640a4fc321c341cf417032028e8b96388ec32
SHA512

1b0d1db28add8ce5676668398b0183508ddda3551c462fd61de24b19f65cbac531a85bc2acb8f771a513ecd376ff1fa8d2669334a74644a1a8265435dccb977e
SSDEEP

1536:G1UDJ+sSDf5obf2Nsu08hIT2QinOmx8Iy0vlM188XSvGsobLTbE2jgY+PCcows8I:G1MZS4QOIK88CvGZEIz+QVdQYqZZkH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4120	2720	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 2720	4556	rundll32.exe	85
PID 4556 wrote to memory of 2720	4556	rundll32.exe	85
PID 4556 wrote to memory of 2720	4556	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\psyzabw.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\psyzabw.dll,#1
  2⤵
  PID:2720
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2720 -s 604
    3⤵
    - Program crash
    PID:4120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 2720 -ip 2720
1⤵
PID:1584