5a4be9e92cf84b6fdedef3623c4fc76a9a239e98f88c0c4368bbb72caafdda03 | Triage

Analysis

max time kernel
92s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
22/02/2024, 11:47

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/StartMenu.dll
Size

7KB
MD5

abba50aeb1da3cd1ad1e79a89701b02e
SHA1

bff5bcc8cb0667934b6c743b3f64f6a594f06826
SHA256

7a4268edf9d327766f22d4126f8dd070db611836f5336af1a864a1f8cfa7939b
SHA512

b730cd5fdca693331e8789318aa5536950bfbd691ec4047eca8dce9f8a4b0f960210261a44fb502839c20f02a20c1027aca23c7e32b84f79c2cca3ba5a3ab13c
SSDEEP

96:UgiqVPb3X8K8Kdr3gEq6nNdMk6Qiw290+q6LDtJ1t33hhEl7y:UgiqVPgK8K9eIdE9B/tnhg7

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1088	3132	WerFault.exe	16

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4164 wrote to memory of 3132	4164	rundll32.exe	16
PID 4164 wrote to memory of 3132	4164	rundll32.exe	16
PID 4164 wrote to memory of 3132	4164	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4164
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#1
  2⤵
  PID:3132
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3132 -s 616
    3⤵
    - Program crash
    PID:1088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3132 -ip 3132
1⤵
PID:3368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads