bb2c0f8952c81ef515102521083091df311b71929dc075a506a93cc5d8855527 | Triage

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 01:43

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/UserInfo.dll
Size

4KB
MD5

a6f622a2f12ac10bca04e23deff5cada
SHA1

abf851b5ccfb64004e9b49718a467bd754545887
SHA256

b8fa7b9393fff910144768588c471ca7c9ec98a2b8b186b2172b8ba7a5279500
SHA512

35c8b0db179104e638f1b40f3f8038a41fdc327e112de5cb0dbb97cbf1dfa276fcf6400fcb46b88cb5ba233ca769becbdb4b4d40920adca831e3c0f38193c50f

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1952 2124 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2288 wrote to memory of 2124	2288	rundll32.exe	rundll32.exe
PID 2288 wrote to memory of 2124	2288	rundll32.exe	rundll32.exe
PID 2288 wrote to memory of 2124	2288	rundll32.exe	rundll32.exe
PID 2288 wrote to memory of 2124	2288	rundll32.exe	rundll32.exe
PID 2288 wrote to memory of 2124	2288	rundll32.exe	rundll32.exe
PID 2288 wrote to memory of 2124	2288	rundll32.exe	rundll32.exe
PID 2288 wrote to memory of 2124	2288	rundll32.exe	rundll32.exe
PID 2124 wrote to memory of 1952	2124	rundll32.exe	WerFault.exe
PID 2124 wrote to memory of 1952	2124	rundll32.exe	WerFault.exe
PID 2124 wrote to memory of 1952	2124	rundll32.exe	WerFault.exe
PID 2124 wrote to memory of 1952	2124	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UserInfo.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2288

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UserInfo.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 220
3⤵
- Program crash
PID:1952

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...