30aecb1d0bb7c6f8de3f21937ff121ccfee96e0454a1e9a156fefbf8accc8770 | Triage

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/01/2024, 08:22

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/Checker.dll
Size

41KB
MD5

1ebcb7fe4d8f8f975dd404d1688d1e1a
SHA1

cff12da173ae6e6660870e6343aac823e013ebc3
SHA256

c78112c3da52d30b98c4cb34d3b9baf406f85a4dc975c40a6949672122c8ed37
SHA512

7ec29be35c39b8fb623eb1f624df984031bc26fb7c99d7375b754ac1bda383e318d01eeae2672a79db6e5b177e29d97a2eb0d60385a80f4a26a5006c7e0173fe
SSDEEP

768:NNZoBQfjXtKahyIXlQWBh/GxHxn2hEDVyx1jZv79FN:NNZwApK0XlLYd9o99L

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3156	5084	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3612 wrote to memory of 5084	3612	rundll32.exe	83
PID 3612 wrote to memory of 5084	3612	rundll32.exe	83
PID 3612 wrote to memory of 5084	3612	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Checker.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3612
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Checker.dll,#1
  2⤵
  PID:5084
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 600
    3⤵
    - Program crash
    PID:3156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5084 -ip 5084
1⤵
PID:2980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads