2368174d9d3c1c6378d4d8e62cc5fbe3b16652ea0752ce8b46e87c7e80cd73ff

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 09:39

Target
$PLUGINSDIR/prubyqu.dll
Size 138KB
Sample240603-lmr7eaac8v
SHA256 40ebf253af2d6f47f627365e301200aea630fa2ed8a115f4a467c3e9e7fc92a4
MD5 bf53df588f76ec220b635d66d0824dc3
SHA1 8644bb57ab3b3ae65b6c7da8fe0b2ec055f7c663
SHA512 40b00f4b379f71a340f110d089a904442156599b53eb0fa5d6c76a1fa805e189a4ef60fb4e9262f86412ef4385d2a936a22fb60ffd2ce31c0a36708d9d18f08c
SSDEEP 3072:lJsbvArT9BeMqoyLQHwHTy7OiF1n4xdf96pJFhf:lJsBo/Qe7Bn1pJFl
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4296	3860	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 3860	2784	rundll32.exe	82
PID 2784 wrote to memory of 3860	2784	rundll32.exe	82
PID 2784 wrote to memory of 3860	2784	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\prubyqu.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\prubyqu.dll,#1
  2⤵
  PID:3860
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3860 -s 600
    3⤵
    - Program crash
    PID:4296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3860 -ip 3860
1⤵
PID:1536