9868e15ce5dee4ac08bbb900151fae026a036f5f80c9b6bc5f8746b64002aec5 | Triage

Resubmissions

14/02/2024, 10:18

240214-mcaeaafg4y 7

14/02/2024, 10:16

240214-masg3sgg75 7

Analysis

max time kernel
86s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2024, 10:18

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/ip.dll
Size

16KB
MD5

4df6320e8281512932a6e86c98de2c17
SHA1

ae6336192d27874f9cd16cd581f1c091850cf494
SHA256

7744a495ceacf8584d4f6786699e94a09935a94929d4861142726562af53faa4
SHA512

7c468de59614f506a2ce8445ef00267625e5a8e483913cdd18636cea543be0ca241891e75979a55bb67eecc11a7ac0649b48b55a10e9a01362a0250839462d3b
SSDEEP

384:BT4+VFqw6WBEyzsyHTsOrohCXgmXBEeGc:vVFqwfBEyAy4OPKe

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4120	4796	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 4796	5100	rundll32.exe	86
PID 5100 wrote to memory of 4796	5100	rundll32.exe	86
PID 5100 wrote to memory of 4796	5100	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ip.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ip.dll,#1
  2⤵
  PID:4796
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 824
    3⤵
    - Program crash
    PID:4120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4796 -ip 4796
1⤵
PID:224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4796-0-0x0000000000720000-0x000000000072A000-memory.dmp

Filesize
40KB

Download