Analysis
-
max time kernel
92s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2024 15:54
Static task
static1
Behavioral task
behavioral1
Sample
Unpaid invoice.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Unpaid invoice.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/gyalquzbu.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/gyalquzbu.dll
Resource
win10v2004-20231215-en
General
-
Target
$PLUGINSDIR/gyalquzbu.dll
-
Size
33KB
-
MD5
a8caa6d267951ad22e835233b5e50c46
-
SHA1
45c722c5958d99727a95d30eaa3032203d1f4ab2
-
SHA256
db7b70b0734285b8d9a1f3617e55603b0cb649d9bf0b7fbf8988c44e684f4e76
-
SHA512
9ee74bf576554210f8923dda8aa28f6dc7f3c5aa52da7b48a94beaf56cb4e27f1c3d0387cc9116e467631bc13c0e743341129bffa84b9db16ace1248a53b4cd7
-
SSDEEP
384:8o2En0QXbRRe9fsWZAmSlmMNAC8Qqgqdq9RHvHZXktPaa+LiJtLydc8f1eWU9Rkj:L2zf9HPaa+2tLKJcMaTxOMFs0o
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1188 4716 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3676 wrote to memory of 4716 3676 rundll32.exe rundll32.exe PID 3676 wrote to memory of 4716 3676 rundll32.exe rundll32.exe PID 3676 wrote to memory of 4716 3676 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\gyalquzbu.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\gyalquzbu.dll,#12⤵PID:4716
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4716 -s 7403⤵
- Program crash
PID:1188
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4716 -ip 47161⤵PID:4292