f8f3812fda1d0d0d729de1e37d310a66df34b8e638dcb5da4ca2605dbb4db57e | Triage

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 05:58

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/UserInfo.dll
Size

4KB
MD5

90228dd140188ec0ca02f7f52e4c9a30
SHA1

6880d9aeec4c97c4b7718044c9c59b92379feaca
SHA256

54bcf3d018734b884bd33a74a05eea0ac3c83501acbdb71ea8ec56ec9402a263
SHA512

1a38b1ebb9e2440dd240c8cd2406261e21b544ed392f808d36f78590075f854d89e624589bfddabcace96b33a7f3084c7686351bd66ae07ec035bbef94ef8da2

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3044 3040 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 3008 wrote to memory of 3040	3008	rundll32.exe	rundll32.exe
PID 3008 wrote to memory of 3040	3008	rundll32.exe	rundll32.exe
PID 3008 wrote to memory of 3040	3008	rundll32.exe	rundll32.exe
PID 3008 wrote to memory of 3040	3008	rundll32.exe	rundll32.exe
PID 3008 wrote to memory of 3040	3008	rundll32.exe	rundll32.exe
PID 3008 wrote to memory of 3040	3008	rundll32.exe	rundll32.exe
PID 3008 wrote to memory of 3040	3008	rundll32.exe	rundll32.exe
PID 3040 wrote to memory of 3044	3040	rundll32.exe	WerFault.exe
PID 3040 wrote to memory of 3044	3040	rundll32.exe	WerFault.exe
PID 3040 wrote to memory of 3044	3040	rundll32.exe	WerFault.exe
PID 3040 wrote to memory of 3044	3040	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UserInfo.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3008

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UserInfo.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:3040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 224
3⤵
- Program crash
PID:3044

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...