4090d442a97bc14a637c1cd5497b43abf6da9b16db8c92953dd181c0dd166ec6 | Triage

Analysis

max time kernel
142s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19/01/2024, 09:34

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/md5dll.dll
Size

6KB
MD5

a3b5cf6ba10ca28215202b03a9b46fa2
SHA1

490936c744b5abc1a9ccc717e65b7e9119397792
SHA256

d55987fc3208498218387f55fe49e661e2a4e7261b204bd3847ff6f37536a6e2
SHA512

1c300f5d4384a695e20b78fc215e5185e030df1e6f078c77752b69e40b7fbc98110a63747d68f3df0f07b0c1d8d27f0731776c0a72463fa6d77527e6779e99d4
SSDEEP

96:ysORmgXlsDQyaM3JOSx1dn1KdkvzFC4lz7E6T16DAlU4dLGcMd66SRJV:y1XjyaM3J/zzL/AE+fcy6j

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1168	3456	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3416 wrote to memory of 3456	3416	rundll32.exe	85
PID 3416 wrote to memory of 3456	3416	rundll32.exe	85
PID 3416 wrote to memory of 3456	3416	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\md5dll.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\md5dll.dll,#1
  2⤵
  PID:3456
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3456 -s 600
    3⤵
    - Program crash
    PID:1168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3456 -ip 3456
1⤵
PID:1980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads