b5f9935e0615cfe328feb5a737d7691dd96b202731e0845bdd3226e64ad96123 | Triage

Analysis

max time kernel
147s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-06-2024 03:34

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/jsis.dll
Size

127KB
MD5

877523e8e5f8eac05f8a90d822b6ff23
SHA1

412d780a501f2d158f3bcc82011f962e3e87ee1a
SHA256

bec5941a991669b2407a72607ecbfd45daf7d19d11b10d0c850f25a2f22f4486
SHA512

872a7dce8044fdf4d4489ad55b0428769a1572a22590009074681fcd757432d3723437d421d601ea590452e41761b2691dd4520e184c8af99035644210ae8ef7
SSDEEP

3072:93Zk9fOAewM0+W8NVH28fB948igEWo8P+fidY:93qNOApM1G8fBpidWZ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3584 3124 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1084 wrote to memory of 3124	1084	rundll32.exe	rundll32.exe
PID 1084 wrote to memory of 3124	1084	rundll32.exe	rundll32.exe
PID 1084 wrote to memory of 3124	1084	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\jsis.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1084

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\jsis.dll,#1
2⤵
PID:3124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3124 -s 632
3⤵
- Program crash
PID:3584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3124 -ip 3124
1⤵
PID:3480

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...