10fb2c2778f11842d7eee6cc2033e8bc2e3fb45f1a24a58427572b4d1461a4fb | Triage

Analysis

max time kernel
142s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-03-2024 09:07

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/fnbvert.dll
Size

158KB
MD5

4dab253abac323efe6b7290426f69b8b
SHA1

e6f6f88a42416a9ce8b994d2a301b8e99ca664a8
SHA256

4b5103433cd2aec8bc27aafdcca1a4e04c5ad13ffff1e4c36e58cf534918fc85
SHA512

0085f2d755b4eef98816ed31f23701270aa62fb4aef697361b6e77eaec5aedec63e13855443fe5b8d5325985289dfbb9d95390ed86c54e0bcebdd8dd9f7f008d
SSDEEP

3072:pulnmaRcGg3LfzhuuP0UUR+ZWLYfeDgUk7d:puiz370Umrpa7

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3916	1436	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4068 wrote to memory of 1436	4068	rundll32.exe	88
PID 4068 wrote to memory of 1436	4068	rundll32.exe	88
PID 4068 wrote to memory of 1436	4068	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\fnbvert.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\fnbvert.dll,#1
  2⤵
  PID:1436
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 600
    3⤵
    - Program crash
    PID:3916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 1436 -ip 1436
1⤵
PID:3208

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads