9661762b367c9b9914e02a274fce181229109e5ddadb224a2dd9e047c35c28e5 | Triage

Analysis

max time kernel
92s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/02/2024, 05:36

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/KuWoNsis_kwsing.dll
Size

49KB
MD5

42e0843575a679ccda86e3109531310f
SHA1

14af6ec94e196f82dae851d7b34c1d9a1048de12
SHA256

30d11d75cbfe70fbd76ad892ab84626840fa6be6b313edafc103de6c372a76fe
SHA512

13ab8caad4c88f99d3eb83e5600cf6f3e4f0dd06092c47d80da2bfa1d1dd97d6d41155be3b15cee7bd550062c02174487a53eb1c18910beac70d504d0d51b7a8
SSDEEP

768:5B++ELJPIzvpOWb1L3HKEZQR/8JqH8DDd3FLWjbCaR:r++yIjpOWb1L3Kb8JFDDrafCaR

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1044	2184	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 100 wrote to memory of 2184	100	rundll32.exe	82
PID 100 wrote to memory of 2184	100	rundll32.exe	82
PID 100 wrote to memory of 2184	100	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\KuWoNsis_kwsing.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:100
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\KuWoNsis_kwsing.dll,#1
  2⤵
  PID:2184
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 604
    3⤵
    - Program crash
    PID:1044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2184 -ip 2184
1⤵
PID:2304

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads