Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
31-03-2024 15:54
Static task
static1
Behavioral task
behavioral1
Sample
Unpaid invoice.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Unpaid invoice.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/gyalquzbu.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/gyalquzbu.dll
Resource
win10v2004-20231215-en
General
-
Target
$PLUGINSDIR/gyalquzbu.dll
-
Size
33KB
-
MD5
a8caa6d267951ad22e835233b5e50c46
-
SHA1
45c722c5958d99727a95d30eaa3032203d1f4ab2
-
SHA256
db7b70b0734285b8d9a1f3617e55603b0cb649d9bf0b7fbf8988c44e684f4e76
-
SHA512
9ee74bf576554210f8923dda8aa28f6dc7f3c5aa52da7b48a94beaf56cb4e27f1c3d0387cc9116e467631bc13c0e743341129bffa84b9db16ace1248a53b4cd7
-
SSDEEP
384:8o2En0QXbRRe9fsWZAmSlmMNAC8Qqgqdq9RHvHZXktPaa+LiJtLydc8f1eWU9Rkj:L2zf9HPaa+2tLKJcMaTxOMFs0o
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2176 1936 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 2940 wrote to memory of 1936 2940 rundll32.exe rundll32.exe PID 2940 wrote to memory of 1936 2940 rundll32.exe rundll32.exe PID 2940 wrote to memory of 1936 2940 rundll32.exe rundll32.exe PID 2940 wrote to memory of 1936 2940 rundll32.exe rundll32.exe PID 2940 wrote to memory of 1936 2940 rundll32.exe rundll32.exe PID 2940 wrote to memory of 1936 2940 rundll32.exe rundll32.exe PID 2940 wrote to memory of 1936 2940 rundll32.exe rundll32.exe PID 1936 wrote to memory of 2176 1936 rundll32.exe WerFault.exe PID 1936 wrote to memory of 2176 1936 rundll32.exe WerFault.exe PID 1936 wrote to memory of 2176 1936 rundll32.exe WerFault.exe PID 1936 wrote to memory of 2176 1936 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\gyalquzbu.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\gyalquzbu.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 2483⤵
- Program crash
PID:2176