4bbb6021ab01478496202bc0cfb7527b068a621093a823c8d02e696da8b6decb | Triage

Analysis

max time kernel
91s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 05:47

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/StartMenu.dll
Size

6KB
MD5

c0a60e2104eb0e4b0eac4eccdc048285
SHA1

7b14600bb1e3120b5cf9aa6d5fd41a6f20f62e42
SHA256

977c38bebc30b0b1de5338ab237ebfdfb7df87450f347d85fad28131f635c172
SHA512

d7bf507c90145373acda753b14eacc89190c61d760ea30aafc864498d09475dfd0336266eab4d95fd53ce03d1e57aa772e3ede29dc67b2f060ed12116e5c5130
SSDEEP

96:yLJdRZk8OkmE+WHw0FMXF6CWhFxKpKsaQhEfP0:yLjPk8OT30FFAHCP0

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4464	1092	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 860 wrote to memory of 1092	860	rundll32.exe	85
PID 860 wrote to memory of 1092	860	rundll32.exe	85
PID 860 wrote to memory of 1092	860	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:860
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#1
  2⤵
  PID:1092
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 600
    3⤵
    - Program crash
    PID:4464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1092 -ip 1092
1⤵
PID:4044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads