21ec25b1f30916e6e87c184f1634871e13be6a31e48adf43f54635a2ee0cba8e

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 08:48

Target

$PLUGINSDIR/gsglynb.dll
Size

126KB
MD5

a891fd7441835e88f87b530434424306
SHA1

f4c541ee8a5aeab4ed9c5aaf970a4a72d913d315
SHA256

b2b8896b7db9f4a7e596e89cfec496c2cf93d284f63bd6b4f842c1b0a41a2b66
SHA512

ef20e1330676e5a3b37f2dec1f5460563934ff432b0a1fe6fadefc8546dee501e92dec4fa0f6869e667fd455f8461457f14d5399c841c4f2291cb711e50d00dc
SSDEEP

1536:Pau2Sp8T0pWxfZHVOwNR2ZtIT+A5Y4LSm1qzZSWm64sjhhgnrc+dWt2Y+TT:KSivxR1Oi+u+eWckh1+dWMYu

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
384	3200	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 3200	1512	rundll32.exe	83
PID 1512 wrote to memory of 3200	1512	rundll32.exe	83
PID 1512 wrote to memory of 3200	1512	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\gsglynb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\gsglynb.dll,#1
  2⤵
  PID:3200
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3200 -s 600
    3⤵
    - Program crash
    PID:384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3200 -ip 3200
1⤵
PID:4344