4bbb6021ab01478496202bc0cfb7527b068a621093a823c8d02e696da8b6decb | Triage

Analysis

max time kernel
93s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 05:47

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/AdvSplash.dll
Size

6KB
MD5

416dd1f9853a601f16c70ee016ee855f
SHA1

226a5aa251118f5e337d22017dd0861f2d8b21d3
SHA256

2cf08655bd37f2999612ced3b79d35b537e2b0cd281bb1f452c427879634e7de
SHA512

27e104a657eaed4cc8f58588385af6354d41785df98c8fc02eb436cb4372e3c0047ec28eab5ab37ef70ddca46fc9cf1cc86fc0d95267fff759ae7e610b5f8d6d
SSDEEP

96:VQNyX2PtUZsM88eo93NaqqhN51xWabkkEkk/StChwoo:VFXYt38B9V61dk/kkStCh

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1496	1880	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 1880	2464	rundll32.exe	84
PID 2464 wrote to memory of 1880	2464	rundll32.exe	84
PID 2464 wrote to memory of 1880	2464	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\AdvSplash.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\AdvSplash.dll,#1
  2⤵
  PID:1880
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1880 -s 616
    3⤵
    - Program crash
    PID:1496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1880 -ip 1880
1⤵
PID:5048

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads