d32a6b84b3ddd7414f68356c7bac609a442afe9e507dc60d7d5a60bc8dd1a1a1

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/05/2024, 03:35

Target

$PLUGINSDIR/ibbbywk.dll
Size

153KB
MD5

0ec43130a05cbe9a126c50efc3d2771d
SHA1

360e4dd81a32aecd3fb4cab67b8cc786f41fa2dd
SHA256

f1f2d35cd64a8b1faf3bb5260d2d18b5e1c22b28b4c9b30a215bd39b626d77ed
SHA512

d2d19dfc18051fab5f449b071206d9d5a73d41d8b7e91e42056de20ae0208d8b957272d068f5e2b12faefd2b3456874dd2f682b14f505a6d5cec9d44781f5b14
SSDEEP

3072:GDCjw5xJnCKvCsX3WhuXnEpxCrPq+QG/Xsp7HO5jHQ:X0HlhUpxCWNG75jHQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1728	2504	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 2504	2072	rundll32.exe	28
PID 2072 wrote to memory of 2504	2072	rundll32.exe	28
PID 2072 wrote to memory of 2504	2072	rundll32.exe	28
PID 2072 wrote to memory of 2504	2072	rundll32.exe	28
PID 2072 wrote to memory of 2504	2072	rundll32.exe	28
PID 2072 wrote to memory of 2504	2072	rundll32.exe	28
PID 2072 wrote to memory of 2504	2072	rundll32.exe	28
PID 2504 wrote to memory of 1728	2504	rundll32.exe	29
PID 2504 wrote to memory of 1728	2504	rundll32.exe	29
PID 2504 wrote to memory of 1728	2504	rundll32.exe	29
PID 2504 wrote to memory of 1728	2504	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ibbbywk.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ibbbywk.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2504
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 224
    3⤵
    - Program crash
    PID:1728