2ff2ba5b37acf3f129832c9f1ceacc6c6148ed71726bc4e262d829ee80430192

Analysis

max time kernel
150s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2024, 20:22

Target

$PLUGINSDIR/TvGetVersion.dll
Size

222KB
MD5

b9e0c430596b2435971079edd15d3f0c
SHA1

fc214c6757e3539729e42f754c6b9768fd44a942
SHA256

c1ec07d1faf59ecdc0c8c1cd258b2feb6d41321471a8c1b10b00100c7106bd7e
SHA512

93dc70fc6fcc4c0f4bc5fc5819446dc465360ef459a0be408bd07a78229f297da12d602b0667145d9716514e8f3da3582b1c4c0e3e9524e39c4a0c8fe7d4e25b
SSDEEP

3072:DZiMB8EvkPz8LbdT3nB9pRdySGnXmEegCtzIItsYUl3UH4K+tv:NiMB8hz8djnBTySKWjW3tEYtR

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
724	5084	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4392 wrote to memory of 5084	4392	rundll32.exe	88
PID 4392 wrote to memory of 5084	4392	rundll32.exe	88
PID 4392 wrote to memory of 5084	4392	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\TvGetVersion.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\TvGetVersion.dll,#1
  2⤵
  PID:5084
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 848
    3⤵
    - Program crash
    PID:724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5084 -ip 5084
1⤵
PID:876

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact