8513ac042c987c6d67779b532018e46be4762b3a6082348c53ab49ba7ac91b5b | Triage

Analysis

max time kernel
26s
max time network
20s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 03:19

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/UserInfo.dll
Size

4KB
MD5

e167f9a565781a30c03ff10370033319
SHA1

1858758b076946073de375c6eb1bec9867aa3689
SHA256

a912514823df595ba3a048099d3b89e925a4d41742afc67e772060952892f312
SHA512

96d8f5ac8e2c0961ba71075de52d12515e7a058cddf3fa1ec14e77545b0b5f4e29324a13e2eb287a447f1d24dc9f09e0a70b0a25401b0ef8d90e6e4a96ce6c61

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2984 1740 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2264 wrote to memory of 1740	2264	rundll32.exe	rundll32.exe
PID 2264 wrote to memory of 1740	2264	rundll32.exe	rundll32.exe
PID 2264 wrote to memory of 1740	2264	rundll32.exe	rundll32.exe
PID 2264 wrote to memory of 1740	2264	rundll32.exe	rundll32.exe
PID 2264 wrote to memory of 1740	2264	rundll32.exe	rundll32.exe
PID 2264 wrote to memory of 1740	2264	rundll32.exe	rundll32.exe
PID 2264 wrote to memory of 1740	2264	rundll32.exe	rundll32.exe
PID 1740 wrote to memory of 2984	1740	rundll32.exe	WerFault.exe
PID 1740 wrote to memory of 2984	1740	rundll32.exe	WerFault.exe
PID 1740 wrote to memory of 2984	1740	rundll32.exe	WerFault.exe
PID 1740 wrote to memory of 2984	1740	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UserInfo.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2264

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UserInfo.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 220
3⤵
- Program crash
PID:2984

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...