112f8ae971c876463d510580ceee9e3585f38a601208b963d9181c64f2ea8ba3 | Triage

Analysis

max time kernel
139s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/01/2024, 12:40

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/aal.dll
Size

104KB
MD5

ffbdc15f5bd54d27777ce33f6db4c710
SHA1

92895c6c2659bafa4158ceb61b74c1b8f26a46d3
SHA256

fa96425d95d5d875d1695b1a803d9407b6b1753b371e1a83860254d91a345a4c
SHA512

27953f296662096780b6820af09b495c25c42d36cdfbaa7b38b5f52c21e793f71aca8e638090ba6f279c17b7341e76bfcabdb12987ef443fdd573b70f9566d7d
SSDEEP

1536:Y3vqrQfRZRd29pAnC/QqPfTxw/mubtewvuQnj42Xi/g:EvqcfRs9iKgpJvuQnj42S

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3600	2244	WerFault.exe	22

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 2244	2572	rundll32.exe	22
PID 2572 wrote to memory of 2244	2572	rundll32.exe	22
PID 2572 wrote to memory of 2244	2572	rundll32.exe	22

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\aal.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\aal.dll,#1
  2⤵
  PID:2244
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 600
    3⤵
    - Program crash
    PID:3600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2244 -ip 2244
1⤵
PID:3204

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads