024d4f4c51543c7511bf843e08d541b182116cac397d2755d11938975c5be6d5 | Triage

Analysis

max time kernel
92s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 14:21

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/System.dll
Size

9KB
MD5

417877a5d5f1e8e543b4585faa1141ec
SHA1

d4b3cc3dc987e9c421a280dc9f67e3bf1afdaf51
SHA256

24d96a8b14257ede93df3e1533c6b8b1c370696c0815dc450c872ce80184462a
SHA512

63d516c8258659c0a236fbf1725140cbd51ffa09b19794de145b10347c4e8e670d99f09978f36961e154fd2ee7c288c102bbb05ab9c898c740865515f6e769bd
SSDEEP

192:BEnGTkzww33gFsh1wrlI5/YAZ42F+0hCyhvvr:a3+sheRa/YQDFoqvv

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
532	1096	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 1096	4968	rundll32.exe	85
PID 4968 wrote to memory of 1096	4968	rundll32.exe	85
PID 4968 wrote to memory of 1096	4968	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
  2⤵
  PID:1096
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1096 -s 612
    3⤵
    - Program crash
    PID:532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1096 -ip 1096
1⤵
PID:3804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads