e5ebc473e259ec57e2a831477b449dd07c13198c0db74ce67732a8fce59e25ac

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/03/2024, 10:32

Target
$PLUGINSDIR/ylbzgkuxqsi.dll
Size 31KB
Sample240330-mldhasea53
SHA256 23e80d01cf007b17f91366fb1866568f0385ff08767434728f209535d3452fdd
MD5 51d6f1227b9a2e0b090c9d0dab9d4528
SHA1 43149a31386cd9613c5b0e8a218f1e7cc7f77af8
SHA512 b85fd793d0ddf2e96833b458fee64008ff13a863a4b9ba044bf916efc41947fdadc13cfb1deaa151d58c162d706e32226e14ea2a7ba82557eccff329c9e38afb
SSDEEP 768:ovoaaC/7aXedJGhoDJLpKQmZuu82bkBYQo/LukLt3KWA:ovoaaC/76eHGhippKQmZuu1wBYBLRJKX
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2748	1720	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 1720	1504	rundll32.exe	28
PID 1504 wrote to memory of 1720	1504	rundll32.exe	28
PID 1504 wrote to memory of 1720	1504	rundll32.exe	28
PID 1504 wrote to memory of 1720	1504	rundll32.exe	28
PID 1504 wrote to memory of 1720	1504	rundll32.exe	28
PID 1504 wrote to memory of 1720	1504	rundll32.exe	28
PID 1504 wrote to memory of 1720	1504	rundll32.exe	28
PID 1720 wrote to memory of 2748	1720	rundll32.exe	29
PID 1720 wrote to memory of 2748	1720	rundll32.exe	29
PID 1720 wrote to memory of 2748	1720	rundll32.exe	29
PID 1720 wrote to memory of 2748	1720	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ylbzgkuxqsi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ylbzgkuxqsi.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1720
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 276
    3⤵
    - Program crash
    PID:2748