cc8983b7309b663c1c72075936be3f57cd11b602d4f60e7a642c709823bbf294 | Triage

Analysis

max time kernel
144s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-02-2024 21:23

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/inetc.dll
Size

17KB
MD5

6d8c0a8cfa17d5f514df99e0ea308eb7
SHA1

4ed5be09ce30f700f9b31bd1b8ab088bdbcb5edd
SHA256

715aee91a2d817c32c06ce12e20c6b499bdcc8d368f312fc58074a01f5dbbbe8
SHA512

f2f444576fbdd1af1f3b782c895e98180791567d0939ebfee37bbc7d965e867f017f2436a8ca0aaaf67d65a307b90b1d49328f4677547af605344aecca242192
SSDEEP

384:AnJJ9vt9UoWYNLt1XtoXgOM6UsyyFGL00Ac9khYLMkIX0+G+itGu:Anrm5YNLDxOM6UsfGL4

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3628	4940	WerFault.exe	95

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 4940	1052	rundll32.exe	95
PID 1052 wrote to memory of 4940	1052	rundll32.exe	95
PID 1052 wrote to memory of 4940	1052	rundll32.exe	95

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\inetc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\inetc.dll,#1
  2⤵
  PID:4940
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4940 -s 632
    3⤵
    - Program crash
    PID:3628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4940 -ip 4940
1⤵
PID:3864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1028 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8
1⤵
PID:360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads