e7490d25eb3e1553ec66c42b1474a2ff025072f3017eb882f7b15da0379ce9e0 | Triage

Analysis

max time kernel
1372s
max time network
1179s
platform
windows10-2004_x64
resource
win10v2004-20240221-uk
resource tags

arch:x64arch:x86image:win10v2004-20240221-uklocale:uk-uaos:windows10-2004-x64systemwindows
submitted
25-02-2024 20:41

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/KRPlugin_aki.dll
Size

10.8MB
MD5

c52da73194e49c3a6294e2f410b86eb2
SHA1

e3382c3772275456dfa7703bf0a687c62650eb1e
SHA256

d74157d4ce460e850f3aab606f8fa51e1411c95b70ea353b52dab158cf385860
SHA512

69cb63fd5c593196496ee94b19217c08594330aab62e324c2f556ba499e41f419719fabdd85ee8ea1df1924848bbace595785704480052875698aa5b2a67f94c
SSDEEP

196608:odxDer6maEN4/vD6TWtmIHI8BaQsLtq/isoWeXky/d:Mw3aV2TW0Io8B7oWcd

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5104 2036 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4720 wrote to memory of 2036	4720	rundll32.exe	rundll32.exe
PID 4720 wrote to memory of 2036	4720	rundll32.exe	rundll32.exe
PID 4720 wrote to memory of 2036	4720	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\KRPlugin_aki.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4720

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\KRPlugin_aki.dll,#1
2⤵
PID:2036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 736
3⤵
- Program crash
PID:5104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 180 -p 2036 -ip 2036
1⤵
PID:1972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2036-0-0x0000000061E00000-0x0000000061EF8000-memory.dmp

Filesize
992KB

Download