2b439a03a70011aaae44b6b2b56953188c6607d547b7aa3f5d6924bce9ef5d18 | Triage

Analysis

max time kernel
131s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/01/2024, 17:19

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/Delay.dll
Size

7KB
MD5

4602d9a9ed82d646522ead08a58536a9
SHA1

b070bad90e13e85c97bd4e530ca7958c22e36a5a
SHA256

b6691bf37f13e37bfc07d45990092fd9398f7eff8cb1bbad05e528def0307c4a
SHA512

5ebad4e83d411799a25b1e462ac3c7683dd0c973f131eed29131af7a240f92f55e6c60b78f96388bf7c4134941353794d79ef6c91476e8def7e5c803544afec9
SSDEEP

96:fkcYhKlqWFeJ9DekCN3jPpP4DyGE3qLNf:cXKMJRC5BfGE3qLN

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4908	2120	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 2120	4828	rundll32.exe	86
PID 4828 wrote to memory of 2120	4828	rundll32.exe	86
PID 4828 wrote to memory of 2120	4828	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Delay.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Delay.dll,#1
  2⤵
  PID:2120
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 604
    3⤵
    - Program crash
    PID:4908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2120 -ip 2120
1⤵
PID:4552

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads