8363d012b83800ad66b80801e6267345d35a43ba6f1335baa5483332b36840a5 | Triage

Analysis

max time kernel
133s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27-06-2024 09:24

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/UserInfo.dll
Size

4KB
MD5

a6f622a2f12ac10bca04e23deff5cada
SHA1

abf851b5ccfb64004e9b49718a467bd754545887
SHA256

b8fa7b9393fff910144768588c471ca7c9ec98a2b8b186b2172b8ba7a5279500
SHA512

35c8b0db179104e638f1b40f3f8038a41fdc327e112de5cb0dbb97cbf1dfa276fcf6400fcb46b88cb5ba233ca769becbdb4b4d40920adca831e3c0f38193c50f

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1640 3660 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3260 wrote to memory of 3660	3260	rundll32.exe	rundll32.exe
PID 3260 wrote to memory of 3660	3260	rundll32.exe	rundll32.exe
PID 3260 wrote to memory of 3660	3260	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UserInfo.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3260

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UserInfo.dll,#1
2⤵
PID:3660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3660 -s 612
3⤵
- Program crash
PID:1640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3660 -ip 3660
1⤵
PID:2320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...