7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d | Triage

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
29-06-2024 06:52

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/System.dll
Size

10KB
MD5

da802677276c27b430cfb11c9da0bed2
SHA1

6893b15fdd34fae3d35bc5b01355a5a919dd9a7b
SHA256

756861c52304402a3fc2e0fc9f3ecc8ebb546916fc2812f1df5f2e63da1c5a82
SHA512

0b212788ccca336fe228335189ec3bd0dc207c296cf3b219a88511c44735f8e1913bf745699be0f29078a47adc0442e4ff891c0877541ccbcfa1ad5e4dc1b187
SSDEEP

192:XOycJo/rJVCmIDNLU0dq5RD00lspbub76HL:B/QQ0d0RD0USq/6H

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2864 2088 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1860 wrote to memory of 2088	1860	rundll32.exe	rundll32.exe
PID 1860 wrote to memory of 2088	1860	rundll32.exe	rundll32.exe
PID 1860 wrote to memory of 2088	1860	rundll32.exe	rundll32.exe
PID 1860 wrote to memory of 2088	1860	rundll32.exe	rundll32.exe
PID 1860 wrote to memory of 2088	1860	rundll32.exe	rundll32.exe
PID 1860 wrote to memory of 2088	1860	rundll32.exe	rundll32.exe
PID 1860 wrote to memory of 2088	1860	rundll32.exe	rundll32.exe
PID 2088 wrote to memory of 2864	2088	rundll32.exe	WerFault.exe
PID 2088 wrote to memory of 2864	2088	rundll32.exe	WerFault.exe
PID 2088 wrote to memory of 2864	2088	rundll32.exe	WerFault.exe
PID 2088 wrote to memory of 2864	2088	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1860

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2088 -s 224
3⤵
- Program crash
PID:2864

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...