fb8844d36e0b52aa5cd7a8e1983d8ba2b4b99d8fb77839515064d2c619f93add | Triage

Analysis

max time kernel
146s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
29-06-2024 09:11

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/System.dll
Size

11KB
MD5

0ac4d26689bd27aa2856b96007be3cfa
SHA1

e149c1f77ac35cb335f4b33d258df4420580e514
SHA256

9e7ac4e2ca2fec46ab51d5b6d4868c76de684f65d375482c37be4be39bcf3b49
SHA512

8040a48231ddade86991652e9cb72e9a487766730032abe52c713562cf914092e5397a328b6d59464846cc5ff0d00dea92e6ed69d9b480acae8c6053addb3b58
SSDEEP

192:KN2gQuUwXzioj4KALV2upWzVd7q1QDXEbBZ8KxHdGzyS/sx:pJoiO8V2upW7vQjS/

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4684 3692 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 576 wrote to memory of 3692	576	rundll32.exe	rundll32.exe
PID 576 wrote to memory of 3692	576	rundll32.exe	rundll32.exe
PID 576 wrote to memory of 3692	576	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:576

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
2⤵
PID:3692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3692 -s 460
3⤵
- Program crash
PID:4684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3692 -ip 3692
1⤵
PID:3976

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...