a00efafb9deb99a99bfdd34f55818983e9cc675d1cac6b71b9fec4b0bea1aa56 | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 08:22

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/UserInfo.dll
Size

4KB
MD5

329f721e5109a9731f114c58c03ca6d1
SHA1

a2b346099a35792d80e1dfe8f408695ef07e05b5
SHA256

6a8aaa3940cc292bdc61603f51c2f8328a8d1614b998485e0de08347631615b6
SHA512

b6eedc986dd80157541be4d65490d0df2ef6ab3248800fb15e23f517ebcff3687c4d4cc51908cd779b50db5d76da6c946f4a05ddc79405248dd91566547cd7ca

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2072 2208 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 288 wrote to memory of 2208	288	rundll32.exe	rundll32.exe
PID 288 wrote to memory of 2208	288	rundll32.exe	rundll32.exe
PID 288 wrote to memory of 2208	288	rundll32.exe	rundll32.exe
PID 288 wrote to memory of 2208	288	rundll32.exe	rundll32.exe
PID 288 wrote to memory of 2208	288	rundll32.exe	rundll32.exe
PID 288 wrote to memory of 2208	288	rundll32.exe	rundll32.exe
PID 288 wrote to memory of 2208	288	rundll32.exe	rundll32.exe
PID 2208 wrote to memory of 2072	2208	rundll32.exe	WerFault.exe
PID 2208 wrote to memory of 2072	2208	rundll32.exe	WerFault.exe
PID 2208 wrote to memory of 2072	2208	rundll32.exe	WerFault.exe
PID 2208 wrote to memory of 2072	2208	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UserInfo.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:288

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UserInfo.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2208 -s 224
3⤵
- Program crash
PID:2072

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...