2ff2ba5b37acf3f129832c9f1ceacc6c6148ed71726bc4e262d829ee80430192

Analysis

max time kernel
19s
max time network
30s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-03-2024 20:22

Target

$PLUGINSDIR/TvGetVersion.dll
Size

203KB
MD5

465ad8b483c5e8bbfee17aa15ea3b488
SHA1

ad984431df286cd6c10796b49c248e6afb4d55bf
SHA256

943149b2cf028bbe593375e255ed834c129f97ed2dab9c3779d871446dc177df
SHA512

8c137cff4aeeee2556233a07d7df9c183c38a36c40d904a89f22d73cc13b3941d71708da89dfe908f335f6c39e4c70b376dd437924e15ac697876f612bdf01d6
SSDEEP

3072:W7dLGQVSy683WSfpcHsV8WhNtjdFj06lZA3+DKw/9bzNhT08g:ILGQVSXMfpysxhTZFj7lGUpNDg

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2592	2036	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 2036	1740	rundll32.exe	27
PID 1740 wrote to memory of 2036	1740	rundll32.exe	27
PID 1740 wrote to memory of 2036	1740	rundll32.exe	27
PID 1740 wrote to memory of 2036	1740	rundll32.exe	27
PID 1740 wrote to memory of 2036	1740	rundll32.exe	27
PID 1740 wrote to memory of 2036	1740	rundll32.exe	27
PID 1740 wrote to memory of 2036	1740	rundll32.exe	27
PID 2036 wrote to memory of 2592	2036	rundll32.exe	30
PID 2036 wrote to memory of 2592	2036	rundll32.exe	30
PID 2036 wrote to memory of 2592	2036	rundll32.exe	30
PID 2036 wrote to memory of 2592	2036	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\TvGetVersion.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\TvGetVersion.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 392
    3⤵
    - Program crash
    PID:2592

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact