f13995db4175e5dbea232776fbbb6758bfed8fe0ba70eaf390b6008a453af7c4 | Triage

Analysis

max time kernel
140s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12-02-2024 20:26

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/xml.dll
Size

649KB
MD5

c4bcabd1e9bf222e55f82c1e2c2f4c05
SHA1

b119ac57235a70c9469313fb4076beeb469d6da3
SHA256

9cc980e775846b9ad69da8adbca8de09d11e5d55e581e0388b53fe22b81fef9d
SHA512

5a77000e6f08af4cddd5f3b7167fbedcbb0f47e75466854bf0b8fd839c17b5423928321cce79b6369dc07afa38c586046833718431ef7056ed5e7fe6c5c9a3ac
SSDEEP

12288:io+WEhu4KKmSdPy11hcB2niHDaG6hh+Whmiya5ccOqW3RBBppAN:UWElKichfh+Wh1yEccFcpAN

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1204 3420 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2568 wrote to memory of 3420	2568	rundll32.exe	rundll32.exe
PID 2568 wrote to memory of 3420	2568	rundll32.exe	rundll32.exe
PID 2568 wrote to memory of 3420	2568	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\xml.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2568

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\xml.dll,#1
2⤵
PID:3420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3420 -s 600
3⤵
- Program crash
PID:1204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3420 -ip 3420
1⤵
PID:3684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads