10012b6185457cc008e74c63602e39ccc862866cfecb5f2ab04b1aa9e9edde9a

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/04/2024, 22:54

Target
$PLUGINSDIR/zglbbz.dll
Size 28KB
Sample240404-2vtyzacf5x
SHA256 ce31d179d783748cf50244baf49d5a59643740c16c0fb77253ddf79b9b2b7048
MD5 2a4a17df7d15fbdd5d79def67aa868c4
SHA1 6f213e4f6c99e9cccc6f885a1fbc208e699bd7c3
SHA512 c9bfc03e6d92645f90c2a35f5b9b42226c4651f6bdafb4d99236f966e88dba3b8188bc44630f7b73cc7817b26f28ea78b72f016dbb845604ee03f0c96a9a0e8e
SSDEEP 384:g97T95oBiNHxHGEahEewcswd3MevEFmJkkdoiWgAhdiFc5/aD9eBEL2WhYTn3gdh:gdp50G0thEwIevOklfCiy5/RBE6Sr
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1612	1624	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 1624	1244	rundll32.exe	28
PID 1244 wrote to memory of 1624	1244	rundll32.exe	28
PID 1244 wrote to memory of 1624	1244	rundll32.exe	28
PID 1244 wrote to memory of 1624	1244	rundll32.exe	28
PID 1244 wrote to memory of 1624	1244	rundll32.exe	28
PID 1244 wrote to memory of 1624	1244	rundll32.exe	28
PID 1244 wrote to memory of 1624	1244	rundll32.exe	28
PID 1624 wrote to memory of 1612	1624	rundll32.exe	29
PID 1624 wrote to memory of 1612	1624	rundll32.exe	29
PID 1624 wrote to memory of 1612	1624	rundll32.exe	29
PID 1624 wrote to memory of 1612	1624	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\zglbbz.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\zglbbz.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1624
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 288
    3⤵
    - Program crash
    PID:1612