d2638877ee593334ebe913b61a62a9cb80c75493f764c416959d34fe8a99897a | Triage

Analysis

max time kernel
132s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
05-05-2024 11:08

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/Sibuia.dll
Size

524KB
MD5

6a3c3c97e92a5949f88311e80268bbb5
SHA1

48c11e3f694b468479bc2c978749d27b5d03faa2
SHA256

7938db73242aafbe80915e4ca886d38be9b7e872b93bdae1e8ee6cf4a005b7d9
SHA512

6141886a889825ccdfa59a419f7670a34ef240c4f90a83bc17223c415f2fbd983280e98e67485710e449746b5bf3284907537bef6ab698a48954dd4910ddf693
SSDEEP

12288:yFlW+6yL4qXm3e39uB9dk6M6g89vYyw7UwogmySQk9GS168q:y/L6yL44oAP7LD7UvCaGSlq

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4776 4568 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4836 wrote to memory of 4568	4836	rundll32.exe	rundll32.exe
PID 4836 wrote to memory of 4568	4836	rundll32.exe	rundll32.exe
PID 4836 wrote to memory of 4568	4836	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Sibuia.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4836

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Sibuia.dll,#1
2⤵
PID:4568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4568 -s 676
3⤵
- Program crash
PID:4776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4568 -ip 4568
1⤵
PID:2576

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...