f855b0097e5bafddf7509035c9abd64a373d72ccafca0bf7e51aa97089a0484a | Triage

Analysis

max time kernel
90s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2022, 21:09

Sharing

Report Analysis Logs

General

Target

Plugins/Plugin_Demo_VC.dll
Size

69KB
MD5

e12b6be4300429bcbb360c4179273197
SHA1

2fae008d827c5a276f77279548d94c8cf4416c60
SHA256

db61c41c757cff88e339be453a762f6674d74636dd28e2ccc963d04c033ce681
SHA512

4c3310993545738454259999711be244fd32b7cbb4dd556ec59d700491cd93d95bb0f4d27157025d369a0209ed11d12e3b295ad22905614b1a1d78e0ed52ce9d
SSDEEP

1536:jg/d0WCCjoFtuWD72SUsB+4XLhk8jvc1ib4AOvHD8lYNr/S:MYC6t1CI5XN5Qcb4bL8aNj

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral4/memory/1824-133-0x0000000010000000-0x0000000010058000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1804	1824	WerFault.exe	42

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 1824	2300	rundll32.exe	42
PID 2300 wrote to memory of 1824	2300	rundll32.exe	42
PID 2300 wrote to memory of 1824	2300	rundll32.exe	42

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\Plugin_Demo_VC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\Plugin_Demo_VC.dll,#1
  2⤵
  PID:1824
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1824 -s 604
    3⤵
    - Program crash
    PID:1804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1824 -ip 1824
1⤵
PID:4744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1824-133-0x0000000010000000-0x0000000010058000-memory.dmp

Filesize
352KB

Download