7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d | Triage

Analysis

max time kernel
144s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29-06-2024 06:52

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/InstallOptions.dll
Size

12KB
MD5

d61d6c709e7947296603059f8bedeba9
SHA1

bdcfc90c358c82be43ef85727a7bdfebbd6d1b69
SHA256

65012a46603b7e13807938e2a61f3c2a60cced3fb3187dfab3e391705e2c3f63
SHA512

ed5a6efd1dd5e2119a9c523b9f9154e13552b3538bf72f4b8b02d6a9c808c3ae2ba7613d9e2b3395237461703f2da0a1482a52727ffcf6fc967552390dab0f2b
SSDEEP

384:sKlm7i+c3QW6ckPhyDEaLnL2bbBBIXwZ:5qi8BcyhEhLibbTI

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4560 2332 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4400 wrote to memory of 2332	4400	rundll32.exe	rundll32.exe
PID 4400 wrote to memory of 2332	4400	rundll32.exe	rundll32.exe
PID 4400 wrote to memory of 2332	4400	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4400

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
2⤵
PID:2332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 624
3⤵
- Program crash
PID:4560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2332 -ip 2332
1⤵
PID:1588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3644 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8
1⤵
PID:2784

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...