b4fc77c70794670f21a4c4fbc3b608589cef7b9d98acadf9b0a956404f6ca0be

Analysis

max time kernel
93s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18-04-2024 20:55

Target

$PLUGINSDIR/fqbakxndgg.dll
Size

27KB
MD5

0ec0b6676a0c830fa1d12a82e0e2ccfc
SHA1

61edae0d4bb19dd31b9ed2ed4d76c99b4f04ebe2
SHA256

c168119aced865f94f0856f3d7419f33142ffe0e8f90c94205d5707b60710617
SHA512

ea5496d61a19ac03a49788d5cc7ae18603ec728c153b9c580f6faa7cfc850c297f9978429627e765467d8130409ca25ce041f0f42065d14fe53c6ef69943e574
SSDEEP

768:OoFu+rc9RGl6YgSs30bktAkra37Wd1+rNHBYD3rHDoMgM3:JhrUGlLAqwaM1C6D3rSA

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1944	4828	WerFault.exe	88

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 4828	4880	rundll32.exe	88
PID 4880 wrote to memory of 4828	4880	rundll32.exe	88
PID 4880 wrote to memory of 4828	4880	rundll32.exe	88
PID 4828 wrote to memory of 3572	4828	rundll32.exe	90
PID 4828 wrote to memory of 3572	4828	rundll32.exe	90
PID 4828 wrote to memory of 3572	4828	rundll32.exe	90
PID 4828 wrote to memory of 3572	4828	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\fqbakxndgg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\fqbakxndgg.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4828
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\fqbakxndgg.dll,#1
    3⤵
    PID:3572
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 712
    3⤵
    - Program crash
    PID:1944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4828 -ip 4828
1⤵
PID:2296

memory/4828-0-0x0000000074A00000-0x0000000074A0A000-memory.dmp

Filesize
40KB

Download
memory/4828-1-0x0000000074A00000-0x0000000074A0A000-memory.dmp

Filesize
40KB

Download