2ff2ba5b37acf3f129832c9f1ceacc6c6148ed71726bc4e262d829ee80430192

Analysis

max time kernel
150s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-03-2024 20:22

Target

$PLUGINSDIR/TvGetVersion.dll
Size

203KB
MD5

465ad8b483c5e8bbfee17aa15ea3b488
SHA1

ad984431df286cd6c10796b49c248e6afb4d55bf
SHA256

943149b2cf028bbe593375e255ed834c129f97ed2dab9c3779d871446dc177df
SHA512

8c137cff4aeeee2556233a07d7df9c183c38a36c40d904a89f22d73cc13b3941d71708da89dfe908f335f6c39e4c70b376dd437924e15ac697876f612bdf01d6
SSDEEP

3072:W7dLGQVSy683WSfpcHsV8WhNtjdFj06lZA3+DKw/9bzNhT08g:ILGQVSXMfpysxhTZFj7lGUpNDg

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1652	348	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 348	2300	rundll32.exe	87
PID 2300 wrote to memory of 348	2300	rundll32.exe	87
PID 2300 wrote to memory of 348	2300	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\TvGetVersion.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\TvGetVersion.dll,#1
  2⤵
  PID:348
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 348 -s 844
    3⤵
    - Program crash
    PID:1652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 348 -ip 348
1⤵
PID:1840

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact