d32a6b84b3ddd7414f68356c7bac609a442afe9e507dc60d7d5a60bc8dd1a1a1 | Triage

Analysis

max time kernel
134s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2024, 03:35

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/ibbbywk.dll
Size

153KB
MD5

0ec43130a05cbe9a126c50efc3d2771d
SHA1

360e4dd81a32aecd3fb4cab67b8cc786f41fa2dd
SHA256

f1f2d35cd64a8b1faf3bb5260d2d18b5e1c22b28b4c9b30a215bd39b626d77ed
SHA512

d2d19dfc18051fab5f449b071206d9d5a73d41d8b7e91e42056de20ae0208d8b957272d068f5e2b12faefd2b3456874dd2f682b14f505a6d5cec9d44781f5b14
SSDEEP

3072:GDCjw5xJnCKvCsX3WhuXnEpxCrPq+QG/Xsp7HO5jHQ:X0HlhUpxCWNG75jHQ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3608	3812	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 3812	1916	rundll32.exe	84
PID 1916 wrote to memory of 3812	1916	rundll32.exe	84
PID 1916 wrote to memory of 3812	1916	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ibbbywk.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ibbbywk.dll,#1
  2⤵
  PID:3812
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3812 -s 600
    3⤵
    - Program crash
    PID:3608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3812 -ip 3812
1⤵
PID:1792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads