ae529dd95d3d7b5667cc3b2df9fb2e28e94bbd40a80c2b7c150a0d3511e4e7b9

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
30/03/2024, 17:23

Target
$PLUGINSDIR/yqbylrwo.dll
Size 42KB
Sample240330-vyevwsbc36
SHA256 0feaffcf57c73f9afc69bdecdb9818def452175101c633a1b39d39018654040c
MD5 e0bd3fde206f2149f8a4a3e2751a20c3
SHA1 1bd4a26d69ce5a2f962e7d8d690704242844186a
SHA512 1b48520702f6c2c95355799a23ed25a2541a715d9a45745b48c1755f3a578bca121503fc96626e7e46b69e54da8a5c75bec41d73dca2d9cbbfd1091fffb3cb75
SSDEEP 768:M8Cn/mA3b7129MW92XqjjHXwEZblF4yM4BWA78Rszu:M8CnuAr7kYXbr4EApa
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1484	4716	WerFault.exe	88

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 4716	4840	rundll32.exe	88
PID 4840 wrote to memory of 4716	4840	rundll32.exe	88
PID 4840 wrote to memory of 4716	4840	rundll32.exe	88
PID 4716 wrote to memory of 3128	4716	rundll32.exe	92
PID 4716 wrote to memory of 3128	4716	rundll32.exe	92
PID 4716 wrote to memory of 3128	4716	rundll32.exe	92
PID 4716 wrote to memory of 3128	4716	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\yqbylrwo.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\yqbylrwo.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4716
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\yqbylrwo.dll,#1
    3⤵
    PID:3128
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4716 -s 688
    3⤵
    - Program crash
    PID:1484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4716 -ip 4716
1⤵
PID:1796

memory/4716-0-0x0000000010000000-0x000000001000D000-memory.dmp

Download