112f8ae971c876463d510580ceee9e3585f38a601208b963d9181c64f2ea8ba3 | Triage

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/01/2024, 12:40

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/aal.dll
Size

104KB
MD5

ffbdc15f5bd54d27777ce33f6db4c710
SHA1

92895c6c2659bafa4158ceb61b74c1b8f26a46d3
SHA256

fa96425d95d5d875d1695b1a803d9407b6b1753b371e1a83860254d91a345a4c
SHA512

27953f296662096780b6820af09b495c25c42d36cdfbaa7b38b5f52c21e793f71aca8e638090ba6f279c17b7341e76bfcabdb12987ef443fdd573b70f9566d7d
SSDEEP

1536:Y3vqrQfRZRd29pAnC/QqPfTxw/mubtewvuQnj42Xi/g:EvqcfRs9iKgpJvuQnj42S

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2404	2088	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2088	1964	rundll32.exe	28
PID 1964 wrote to memory of 2088	1964	rundll32.exe	28
PID 1964 wrote to memory of 2088	1964	rundll32.exe	28
PID 1964 wrote to memory of 2088	1964	rundll32.exe	28
PID 1964 wrote to memory of 2088	1964	rundll32.exe	28
PID 1964 wrote to memory of 2088	1964	rundll32.exe	28
PID 1964 wrote to memory of 2088	1964	rundll32.exe	28
PID 2088 wrote to memory of 2404	2088	rundll32.exe	29
PID 2088 wrote to memory of 2404	2088	rundll32.exe	29
PID 2088 wrote to memory of 2404	2088	rundll32.exe	29
PID 2088 wrote to memory of 2404	2088	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\aal.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\aal.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2088
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2088 -s 224
    3⤵
    - Program crash
    PID:2404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads