1d0e997a1e0cca7446644a5082da18ea191862c85a3e222b0296bdb158c2a387

Analysis

max time kernel
91s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04-04-2024 01:16

Target

$PLUGINSDIR/gyyrofsvwt.dll
Size

30KB
MD5

593ae51744a3a1518c88249d88f6e0d8
SHA1

799fc91d7871e4387fd487da8c066a5908263088
SHA256

f5b07baf233029ae6a86a512fd84161c07d27827ef0222eea9783296249f646b
SHA512

91d538a964f803b97b5983ca7bfab265cbfca1d481c9da7038d478bef56cea033cd9fc7acaf18b5a9680fb684cacab950df66fc9b4264ba8b5ed63c56e80cf6a
SSDEEP

384:qXR1YCNE0PHVORyEN1EzzSO4A37//YriYpYz83wolkxZP8Zi9Gsn9/0VlFaCu5Qi:qB1jE0NORy+O4Y7Hw/pUoksZeG+9/MA

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3180 4724 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3180	4724	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 4008 wrote to memory of 4724	4008	rundll32.exe	rundll32.exe
PID 4008 wrote to memory of 4724	4008	rundll32.exe	rundll32.exe
PID 4008 wrote to memory of 4724	4008	rundll32.exe	rundll32.exe
PID 4724 wrote to memory of 1364	4724	rundll32.exe	rundll32.exe
PID 4724 wrote to memory of 1364	4724	rundll32.exe	rundll32.exe
PID 4724 wrote to memory of 1364	4724	rundll32.exe	rundll32.exe
PID 4724 wrote to memory of 1364	4724	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\gyyrofsvwt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4008

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\gyyrofsvwt.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:4724

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\gyyrofsvwt.dll,#1
3⤵
PID:1364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4724 -s 716
3⤵
- Program crash
PID:3180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4724 -ip 4724
1⤵
PID:4856

memory/4724-0-0x0000000074DC0000-0x0000000074DCC000-memory.dmp

Filesize
48KB

Download
memory/4724-1-0x0000000074DC0000-0x0000000074DCC000-memory.dmp

Filesize
48KB

Download