bacf1ae72d809382dc9ceba302a3f1fc91542620767e9d34e5caab2a2619e133 | Triage

Analysis

max time kernel
137s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
15-01-2024 05:41

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/UserInfo.dll
Size

4KB
MD5

1e8e11f465afdabe97f529705786b368
SHA1

ea42bed65df6618c5f5648567d81f3935e70a2a0
SHA256

7d099352c82612ab27ddfd7310c1aa049b58128fb04ea6ea55816a40a6f6487b
SHA512

16566a8c1738e26962139aae893629098dc759e4ac87df3e8eb9819df4e0e422421836bb1e4240377e00fb2f4408ce40f40eee413d0f6dd2f3a4e27a52d49a0b

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2612	4352	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 4352	2528	rundll32.exe	85
PID 2528 wrote to memory of 4352	2528	rundll32.exe	85
PID 2528 wrote to memory of 4352	2528	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UserInfo.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UserInfo.dll,#1
  2⤵
  PID:4352
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 612
    3⤵
    - Program crash
    PID:2612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4352 -ip 4352
1⤵
PID:4388

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads