bacf1ae72d809382dc9ceba302a3f1fc91542620767e9d34e5caab2a2619e133 | Triage

Analysis

max time kernel
137s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
15-01-2024 05:41

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/Base64.dll
Size

3KB
MD5

5cd56a89f090c3dd0b4d98dfeb3b648d
SHA1

7c1a2a72cdd2f13bd095a4d2eda6b3a9806e7334
SHA256

71d1f1bdaaf23618aa36f6e648b35aada1dc6f1ad0eaf8570cdab5f26d8601a9
SHA512

e69a2eb5e8d21da58478fe99ee86341a735bdc3ee05caeb05ae388e9f82f4f577cb687381dc64060cffc6fe5b835a6c104b06b8d6dcc19337cdc48f1a69927ae

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5064	4508	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 4508	2212	rundll32.exe	85
PID 2212 wrote to memory of 4508	2212	rundll32.exe	85
PID 2212 wrote to memory of 4508	2212	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Base64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Base64.dll,#1
  2⤵
  PID:4508
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 600
    3⤵
    - Program crash
    PID:5064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4508 -ip 4508
1⤵
PID:1544

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads