90aea5afb79d4a06dd87604c0e77067079fe149ba7d9c6db2308b64d7ad4d641

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01/04/2024, 22:40

Target
$PLUGINSDIR/zkyayjffrdi.dll
Size 31KB
Sample240401-2lr31shf89
SHA256 1fdc9ecfa8bddd5c3d7b77913cec4dba53263dac5b8f35cde40e920a58f2deca
MD5 5850eabb38f5b0d1922054acd9b9f2c2
SHA1 be60273f8322a4bf9fc6751c7c524a6b03822f50
SHA512 cbafa1d03004a692851c1d9306e9c08d43d34f36f10d7c084d308e41e7c38a1774bc674ff6a230a5dd905b2dad91703f52c974fed42f0ebae179af05b257f885
SSDEEP 768:WkJszi/0uyQzByH82eZ/lJlFm12nL7w0Tt:Ezd1QzBU82eZ9U10
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2444	2144	WerFault.exe	86

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 2144	848	rundll32.exe	86
PID 848 wrote to memory of 2144	848	rundll32.exe	86
PID 848 wrote to memory of 2144	848	rundll32.exe	86
PID 2144 wrote to memory of 4460	2144	rundll32.exe	89
PID 2144 wrote to memory of 4460	2144	rundll32.exe	89
PID 2144 wrote to memory of 4460	2144	rundll32.exe	89
PID 2144 wrote to memory of 4460	2144	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\zkyayjffrdi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\zkyayjffrdi.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2144
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\zkyayjffrdi.dll,#1
    3⤵
    PID:4460
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2144 -s 756
    3⤵
    - Program crash
    PID:2444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2144 -ip 2144
1⤵
PID:4260

memory/2144-0-0x0000000075430000-0x000000007543B000-memory.dmp

Download

memory/2144-1-0x0000000075430000-0x000000007543B000-memory.dmp

Download