105f62cffef83438fca7377ed8a6e23718be29cf8d93a519178e7138133efda8 | Triage

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
06/06/2024, 05:23

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/fqybjyq.dll
Size

113KB
MD5

2f253ee9fde67de32cc96ead27479cdc
SHA1

b138e5c13d229bb3d49256f25edc7dfce98ce0e4
SHA256

27a1a6b45c11cbf674805def6e9cbad880adeba7a1e9f84d0fd39d0b9c55b4ac
SHA512

eb3cff2fe305796f22287b066bf67e3e2e38d18d8d683792b1b211ed27955d09b8f37d98b18857ceb60ca0eb3cbcd2f48b1824b2aa474a5953dad40a81933518
SSDEEP

1536:oeAxl+e6oqR/3i6uGHu+Zz7rGJrbGP+6UI4TWG+Co6tTDfsONHo:8AaG/RheuUH+CptTDfsONH

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4940	4016	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 4016	3016	rundll32.exe	83
PID 3016 wrote to memory of 4016	3016	rundll32.exe	83
PID 3016 wrote to memory of 4016	3016	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\fqybjyq.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\fqybjyq.dll,#1
  2⤵
  PID:4016
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 600
    3⤵
    - Program crash
    PID:4940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4016 -ip 4016
1⤵
PID:1896

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads