7ad39bfaf9ce17c54262523ec8c76e597f870b29226f40a10f8d4df03c308d4d | Triage

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29-06-2024 06:52

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/System.dll
Size

10KB
MD5

da802677276c27b430cfb11c9da0bed2
SHA1

6893b15fdd34fae3d35bc5b01355a5a919dd9a7b
SHA256

756861c52304402a3fc2e0fc9f3ecc8ebb546916fc2812f1df5f2e63da1c5a82
SHA512

0b212788ccca336fe228335189ec3bd0dc207c296cf3b219a88511c44735f8e1913bf745699be0f29078a47adc0442e4ff891c0877541ccbcfa1ad5e4dc1b187
SSDEEP

192:XOycJo/rJVCmIDNLU0dq5RD00lspbub76HL:B/QQ0d0RD0USq/6H

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5048 4436 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2220 wrote to memory of 4436	2220	rundll32.exe	rundll32.exe
PID 2220 wrote to memory of 4436	2220	rundll32.exe	rundll32.exe
PID 2220 wrote to memory of 4436	2220	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2220

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
2⤵
PID:4436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4436 -s 612
3⤵
- Program crash
PID:5048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4436 -ip 4436
1⤵
PID:2364

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...