35a51326ab147368cf6078a8828fd8a872a94fcaaeb1511c3bd82665daa26fac

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 04:30

Target

$PLUGINSDIR/esbdhnf.dll
Size

166KB
MD5

5e424d2a9625073f5d210085939cb45a
SHA1

b1880f0cd48a05aeb3e3fa6aca453ceb2ee8844a
SHA256

cf70f58f97c6040c3c1e39a2808d9feeb46062d1bd5093cff10a9bac320fc4de
SHA512

063da8df2fd23299b6672107f9885958270d2e0483d78a1071a83bf1174a3f4514faa447e80ea1cf5249ffdc805503a244385559f3d72fb5a3b07f66eac81d08
SSDEEP

3072:G560cP4TkquK4/iy7YVGikCdorv+8q9swY/aoplX:k60cPj6aYjdoLVyoplX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1288	1960	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 1960	2444	rundll32.exe	28
PID 2444 wrote to memory of 1960	2444	rundll32.exe	28
PID 2444 wrote to memory of 1960	2444	rundll32.exe	28
PID 2444 wrote to memory of 1960	2444	rundll32.exe	28
PID 2444 wrote to memory of 1960	2444	rundll32.exe	28
PID 2444 wrote to memory of 1960	2444	rundll32.exe	28
PID 2444 wrote to memory of 1960	2444	rundll32.exe	28
PID 1960 wrote to memory of 1288	1960	rundll32.exe	29
PID 1960 wrote to memory of 1288	1960	rundll32.exe	29
PID 1960 wrote to memory of 1288	1960	rundll32.exe	29
PID 1960 wrote to memory of 1288	1960	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\esbdhnf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\esbdhnf.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1960
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 220
    3⤵
    - Program crash
    PID:1288