e76e72cf637809c754a72a2f8f5d54cee242c5465e59ecf9ead85d69ef71fef7 | Triage

Analysis

max time kernel
138s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 11:13

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/UserInfo.dll
Size

4KB
MD5

90228dd140188ec0ca02f7f52e4c9a30
SHA1

6880d9aeec4c97c4b7718044c9c59b92379feaca
SHA256

54bcf3d018734b884bd33a74a05eea0ac3c83501acbdb71ea8ec56ec9402a263
SHA512

1a38b1ebb9e2440dd240c8cd2406261e21b544ed392f808d36f78590075f854d89e624589bfddabcace96b33a7f3084c7686351bd66ae07ec035bbef94ef8da2

Score

3^/10

Malware Config

Signatures

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

1404 3488 WerFault.exe rundll32.exe
456 3488 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 4756 wrote to memory of 3488	4756	rundll32.exe	rundll32.exe
PID 4756 wrote to memory of 3488	4756	rundll32.exe	rundll32.exe
PID 4756 wrote to memory of 3488	4756	rundll32.exe	rundll32.exe
PID 3488 wrote to memory of 1404	3488	rundll32.exe	WerFault.exe
PID 3488 wrote to memory of 1404	3488	rundll32.exe	WerFault.exe
PID 3488 wrote to memory of 1404	3488	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UserInfo.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4756

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UserInfo.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:3488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 612
3⤵
- Program crash
PID:1404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 612
3⤵
- Program crash
PID:456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3488 -ip 3488
1⤵
PID:1044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4172 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:4156

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...