03a948c55d5867c9d6a004819ab5a157825ad1e75fd2239d2040d0f12251f83c | Triage

Analysis

max time kernel
195s
max time network
208s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2024, 19:36

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/utils.dll
Size

60KB
MD5

ae97029e01393cb7ba395504c49d9fe2
SHA1

247b4e1b4100b8ba426fe8957b9de3f32b1bbaee
SHA256

eff23a5d372e18b5647ab812e7600eaa84a893ce64f72c96e02592b96f93866b
SHA512

5bdb06feeeb8ec51a760e804678ed9d67b7622466b40004d6ff4304d6e3e2b5c3dd6a377ce71a025b5658865f826c97069219c0a763ba28ba01d0127949fbc51
SSDEEP

768:mZjOX1HRn5MO7b0u6lv1hssQ55o4bECSq5GatiR:SjOFBE9hrg5olOtiR

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3536	1548	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4628 wrote to memory of 1548	4628	rundll32.exe	88
PID 4628 wrote to memory of 1548	4628	rundll32.exe	88
PID 4628 wrote to memory of 1548	4628	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\utils.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\utils.dll,#1
  2⤵
  PID:1548
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 648
    3⤵
    - Program crash
    PID:3536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1548 -ip 1548
1⤵
PID:2528

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads