2368174d9d3c1c6378d4d8e62cc5fbe3b16652ea0752ce8b46e87c7e80cd73ff

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 09:39

Target
$PLUGINSDIR/prubyqu.dll
Size 138KB
Sample240603-lmr7eaac8v
SHA256 40ebf253af2d6f47f627365e301200aea630fa2ed8a115f4a467c3e9e7fc92a4
MD5 bf53df588f76ec220b635d66d0824dc3
SHA1 8644bb57ab3b3ae65b6c7da8fe0b2ec055f7c663
SHA512 40b00f4b379f71a340f110d089a904442156599b53eb0fa5d6c76a1fa805e189a4ef60fb4e9262f86412ef4385d2a936a22fb60ffd2ce31c0a36708d9d18f08c
SSDEEP 3072:lJsbvArT9BeMqoyLQHwHTy7OiF1n4xdf96pJFhf:lJsBo/Qe7Bn1pJFl
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2188	2436	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2436	2416	rundll32.exe	28
PID 2416 wrote to memory of 2436	2416	rundll32.exe	28
PID 2416 wrote to memory of 2436	2416	rundll32.exe	28
PID 2416 wrote to memory of 2436	2416	rundll32.exe	28
PID 2416 wrote to memory of 2436	2416	rundll32.exe	28
PID 2416 wrote to memory of 2436	2416	rundll32.exe	28
PID 2416 wrote to memory of 2436	2416	rundll32.exe	28
PID 2436 wrote to memory of 2188	2436	rundll32.exe	29
PID 2436 wrote to memory of 2188	2436	rundll32.exe	29
PID 2436 wrote to memory of 2188	2436	rundll32.exe	29
PID 2436 wrote to memory of 2188	2436	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\prubyqu.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\prubyqu.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2436
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2436 -s 220
    3⤵
    - Program crash
    PID:2188