19428f9c431fb0f8d6fbd9ca194589bacf9d9d3e475717031373b71982bea2a5

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01/04/2024, 15:42

Target
$PLUGINSDIR/yhjjbtf.dll
Size 33KB
Sample240401-s5txaagf3x
SHA256 520857c7a5bfaeebf0f39504ae85d32b7e153774e93cb2be486f9a5d35b76d05
MD5 2109a0431e1e8fbce8007bc6dbdc8d2d
SHA1 f85d1cfa01ca893063af01510115bc279da84c2a
SHA512 a190901c467b65b18370aa3dbec9bb994294042fb78965b6baaf92a31fdc316912679a23f81f76a0d30f51c9c9ccbabcd58b0d420a1c6060508de1f0c0d320fb
SSDEEP 384:173rOmBpuRkCafMEILJBJn0GMZEhE7flHeKCB5qktAX6KiAEHpMUK6rbT7:171YiCeIdBMZT7f5eL5XfLzMUKcbX
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4416	2448	WerFault.exe	85

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 2448	2816	rundll32.exe	85
PID 2816 wrote to memory of 2448	2816	rundll32.exe	85
PID 2816 wrote to memory of 2448	2816	rundll32.exe	85
PID 2448 wrote to memory of 4900	2448	rundll32.exe	89
PID 2448 wrote to memory of 4900	2448	rundll32.exe	89
PID 2448 wrote to memory of 4900	2448	rundll32.exe	89
PID 2448 wrote to memory of 4900	2448	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\yhjjbtf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\yhjjbtf.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\yhjjbtf.dll,#1
    3⤵
    PID:4900
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2448 -s 740
    3⤵
    - Program crash
    PID:4416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2448 -ip 2448
1⤵
PID:2376

memory/2448-0-0x0000000010000000-0x000000001000B000-memory.dmp

Download