b4fc77c70794670f21a4c4fbc3b608589cef7b9d98acadf9b0a956404f6ca0be | Triage

Analysis

max time kernel
93s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18-04-2024 20:55

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/fqbakxndgg.dll
Size

27KB
MD5

0ec0b6676a0c830fa1d12a82e0e2ccfc
SHA1

61edae0d4bb19dd31b9ed2ed4d76c99b4f04ebe2
SHA256

c168119aced865f94f0856f3d7419f33142ffe0e8f90c94205d5707b60710617
SHA512

ea5496d61a19ac03a49788d5cc7ae18603ec728c153b9c580f6faa7cfc850c297f9978429627e765467d8130409ca25ce041f0f42065d14fe53c6ef69943e574
SSDEEP

768:OoFu+rc9RGl6YgSs30bktAkra37Wd1+rNHBYD3rHDoMgM3:JhrUGlLAqwaM1C6D3rSA

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1944 4828 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 4880 wrote to memory of 4828	4880	rundll32.exe	rundll32.exe
PID 4880 wrote to memory of 4828	4880	rundll32.exe	rundll32.exe
PID 4880 wrote to memory of 4828	4880	rundll32.exe	rundll32.exe
PID 4828 wrote to memory of 3572	4828	rundll32.exe	rundll32.exe
PID 4828 wrote to memory of 3572	4828	rundll32.exe	rundll32.exe
PID 4828 wrote to memory of 3572	4828	rundll32.exe	rundll32.exe
PID 4828 wrote to memory of 3572	4828	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\fqbakxndgg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4880

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\fqbakxndgg.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:4828

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\fqbakxndgg.dll,#1
3⤵
PID:3572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 712
3⤵
- Program crash
PID:1944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4828 -ip 4828
1⤵
PID:2296

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4828-0-0x0000000074A00000-0x0000000074A0A000-memory.dmp

Filesize
40KB

Download
memory/4828-1-0x0000000074A00000-0x0000000074A0A000-memory.dmp

Filesize
40KB

Download