23821db04107d705b9b6a16a867aa01c55fc77f4e002efc9263e133d090b5b35 | Triage

Analysis

max time kernel
93s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2024, 14:25

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/LuaBridge.dll
Size

56KB
MD5

4773de0d19eba2e605eabcc632cd9e79
SHA1

5279562175548f1655df285bfe09fcbcce84c986
SHA256

1e5276ca5ec9eb3b62303fbc259b9cccb1722fd1321bb4e3054c231c97a14cad
SHA512

8a72a667953885e5884f9e9dfd021a6ec6fa4b05a46cbeb8fa9b5fc1f95d32ea11ebb579bae20ab85459b0f25044d59239462b7318c454365951c54f387bee53
SSDEEP

1536:7pUaOLGBp3rMRtCgEWWlhHz60a+8Dx/Q0+f:dU5LApctDCVa+Ux/Q0

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2380	2292	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 2292	4892	rundll32.exe	85
PID 4892 wrote to memory of 2292	4892	rundll32.exe	85
PID 4892 wrote to memory of 2292	4892	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LuaBridge.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LuaBridge.dll,#1
  2⤵
  PID:2292
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 636
    3⤵
    - Program crash
    PID:2380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2292 -ip 2292
1⤵
PID:3920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2292-0-0x00000000756A0000-0x00000000756FE000-memory.dmp

Filesize
376KB

Download