108e554f9a900d232f2156033cd9339f1316843befbeaf809f3bdb9186b6970e | Triage™

Analysis

max time kernel
93s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/02/2024, 20:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$PLUGINSDIR/Dialer.dll
Size 3KB
Sample240229-znf3escc2s
SHA256 4742cddec8e5e059ca106fb85f6a2dc690c18461b4cde07b36aa2b25c6e3f2c9
MD5 7666a3ea04037ba2f04512879cf7ae9e
SHA1 5622855c42657d8a4ffc2ad87bbf06d0218ccfe6
SHA512 16e7d4f5cae64da54eda4f9a89e2214f9ad0c7fb8d2173fb1a807fe52180284ad8e834f447720a2d4c4e0ff996cac6ce6c7a6275b4eb66eebb81905b3f6052da
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3052	4524	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 4524	2456	rundll32.exe	87
PID 2456 wrote to memory of 4524	2456	rundll32.exe	87
PID 2456 wrote to memory of 4524	2456	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Dialer.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Dialer.dll,#1
  2⤵
  PID:4524
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 596
    3⤵
    - Program crash
    PID:3052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4524 -ip 4524
1⤵
PID:3388

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads