f92ad1e92780a039397fd62d04affe97f1a65d04e7a41c9b5da6dd3fd265967e | Triage

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24-02-2024 16:20

Sharing

Report Analysis Logs

General

Target

plist.dll
Size

53KB
MD5

ab595bc9a0f6f0d00b1f50a7e81ac5fb
SHA1

5798394a3863c2eb67d541eac914562d831e769c
SHA256

0a1e27ced2f8ce0314353c82f30ee8140fde2e2725c4276390922930aafca773
SHA512

ac6607e0da96e11b54f1d4b2a2c918deb1acad021823df2cc9c27b3d9c9556c29db5fe6aec3e9767999e3c0250544196bed47ff047176adf3fece63baccd2480
SSDEEP

768:VOjVJ0t2d6Q1rk4G5aN0pn6ZWj+Hgq7yeHT9kyLfPPAVXSC6IHpyU:KeMkRQUj+Hgq7DkyLfHAVXSBII

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2224	3988	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 492 wrote to memory of 3988	492	rundll32.exe	85
PID 492 wrote to memory of 3988	492	rundll32.exe	85
PID 492 wrote to memory of 3988	492	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\plist.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:492
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\plist.dll,#1
  2⤵
  PID:3988
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3988 -s 604
    3⤵
    - Program crash
    PID:2224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 3988 -ip 3988
1⤵
PID:2124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads