10012b6185457cc008e74c63602e39ccc862866cfecb5f2ab04b1aa9e9edde9a

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 22:54

Target
$PLUGINSDIR/zglbbz.dll
Size 28KB
Sample240404-2vtyzacf5x
SHA256 ce31d179d783748cf50244baf49d5a59643740c16c0fb77253ddf79b9b2b7048
MD5 2a4a17df7d15fbdd5d79def67aa868c4
SHA1 6f213e4f6c99e9cccc6f885a1fbc208e699bd7c3
SHA512 c9bfc03e6d92645f90c2a35f5b9b42226c4651f6bdafb4d99236f966e88dba3b8188bc44630f7b73cc7817b26f28ea78b72f016dbb845604ee03f0c96a9a0e8e
SSDEEP 384:g97T95oBiNHxHGEahEewcswd3MevEFmJkkdoiWgAhdiFc5/aD9eBEL2WhYTn3gdh:gdp50G0thEwIevOklfCiy5/RBE6Sr
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2340	4112	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3496 wrote to memory of 4112	3496	rundll32.exe	86
PID 3496 wrote to memory of 4112	3496	rundll32.exe	86
PID 3496 wrote to memory of 4112	3496	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\zglbbz.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3496
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\zglbbz.dll,#1
  2⤵
  PID:4112
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4112 -s 696
    3⤵
    - Program crash
    PID:2340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4112 -ip 4112
1⤵
PID:2076