f8f3812fda1d0d0d729de1e37d310a66df34b8e638dcb5da4ca2605dbb4db57e | Triage

Analysis

max time kernel
132s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
02-07-2024 02:14

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/UserInfo.dll
Size

4KB
MD5

90228dd140188ec0ca02f7f52e4c9a30
SHA1

6880d9aeec4c97c4b7718044c9c59b92379feaca
SHA256

54bcf3d018734b884bd33a74a05eea0ac3c83501acbdb71ea8ec56ec9402a263
SHA512

1a38b1ebb9e2440dd240c8cd2406261e21b544ed392f808d36f78590075f854d89e624589bfddabcace96b33a7f3084c7686351bd66ae07ec035bbef94ef8da2

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4100 944 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4884 wrote to memory of 944	4884	rundll32.exe	rundll32.exe
PID 4884 wrote to memory of 944	4884	rundll32.exe	rundll32.exe
PID 4884 wrote to memory of 944	4884	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UserInfo.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4884

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UserInfo.dll,#1
2⤵
PID:944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 944 -s 612
3⤵
- Program crash
PID:4100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 944 -ip 944
1⤵
PID:740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...