4b5352a03ce3ad5ff4f896191197576e95a4d03bb3a775b1c933b47a274a309b | Triage

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 02:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/System.dll
Size

27KB
MD5

a568feaa357f44dd50c5e447fa8ee1b2
SHA1

5c765fad342b756d5ea522087c6f7567b5f3ed57
SHA256

57947a15ad3215185c7e15a5f0da393570845a13ab7b184a07fcefbf97537e48
SHA512

7c8c36c0123de839e677beeba65c1af56c5e85d8f1ff2c94950aed33e026dff3fbda8c49859012862110117977c928b814c0d91c477583a2b8f83d73f3cdf174
SSDEEP

384:ixoXlBT3SaMINWf52+4kb1VunYPLb2O1MnnDGaO5C8JN77hh+uA:iypSvIWb3Jko/MnDGxP3hoF

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process
2668	304	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 304	1972	rundll32.exe	2
PID 1972 wrote to memory of 304	1972	rundll32.exe	2
PID 1972 wrote to memory of 304	1972	rundll32.exe	2
PID 1972 wrote to memory of 304	1972	rundll32.exe	2
PID 1972 wrote to memory of 304	1972	rundll32.exe	2
PID 1972 wrote to memory of 304	1972	rundll32.exe	2
PID 1972 wrote to memory of 304	1972	rundll32.exe	2
PID 304 wrote to memory of 2668	304	rundll32.exe	1
PID 304 wrote to memory of 2668	304	rundll32.exe	1
PID 304 wrote to memory of 2668	304	rundll32.exe	1
PID 304 wrote to memory of 2668	304	rundll32.exe	1

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 304 -s 224
1⤵
- Program crash
PID:2668

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:304

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads