209113be716dd92ebbc8da1c9aa8bb22adfda1da32e168055f3a56b1ddc0bbd5 | Triage

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
23-01-2024 23:55

Sharing

Report Analysis Logs

General

Target

ExtensionManager.dll
Size

81KB
MD5

1abcbd1332cde96fbd79df5f2e0a263d
SHA1

9c2576487c7339921f8daf8aa645636c94099bdb
SHA256

e80b1c88d10b363379c51fbb0834f7ca03606383d9e739c5d391f513747f7670
SHA512

f6bdf4fc1f4b329095a7917fdc720312dafc925194164113ce1b5bbdfd2c957d6caeec8a63d02f82adb88ea1de83d9964867432cb71f18ec1c860e81e986404d
SSDEEP

1536:mSoF8WR2QNMLtynGN9MKo2ckNtbC2UXkph1U2zTrJLqh3jS:mSsvWoGY4tbJ7ugTrJLq0

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2816	4808	WerFault.exe	74

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3100 wrote to memory of 4808	3100	rundll32.exe	74
PID 3100 wrote to memory of 4808	3100	rundll32.exe	74
PID 3100 wrote to memory of 4808	3100	rundll32.exe	74

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ExtensionManager.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3100
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ExtensionManager.dll,#1
  2⤵
  PID:4808
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 600
    3⤵
    - Program crash
    PID:2816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4808 -ip 4808
1⤵
PID:1672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads