24124b15fa8f079623e2dc34b14da6ca3d5912af69022c5c00cbb2602c3b838a | Triage

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
19/01/2024, 18:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/khvbx.dll
Size

152KB
MD5

7662739a6ee08008f23c9768e5450422
SHA1

187698d22490b46c4cb26fa00f8d4fad9c47bc24
SHA256

5c7b456d830097dcdcf3486ba31ed6fc475447a9df903fe37350a195428da5b4
SHA512

195943f40485535689ae8aaea2a5999e3a8d0fe00736b62a922ecfd645579ff66fce8efb678c337e5dcd6e1dd788c693507fafd73514daf13bec5f92835e06d4
SSDEEP

3072:G99t6F0XY0MpiO5YvJq7rVC2+FG/3s0I2/N:4DM0Kp73MG7/N

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4604	4756	WerFault.exe	53

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 4756	1368	rundll32.exe	53
PID 1368 wrote to memory of 4756	1368	rundll32.exe	53
PID 1368 wrote to memory of 4756	1368	rundll32.exe	53

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\khvbx.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\khvbx.dll,#1
  2⤵
  PID:4756
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 600
    3⤵
    - Program crash
    PID:4604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4756 -ip 4756
1⤵
PID:1700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads