79af1f9153b8ff988baffaa164fc70799950078f887e2c93dc3fa7efed674b21 | Triage

Analysis

max time kernel
300s
max time network
306s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12-03-2024 22:20

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/StartMenu.dll
Size

12KB
MD5

fb106f9e525281c3a443ceef2d6e210f
SHA1

8321054b611787d2dacbcb1495c2b627dac04629
SHA256

fe48faafeb1d3bf312d66d60d2207648d0959c7b9263356c81d0d7f626333aa3
SHA512

d9fd571b0a27fd055a21b539dfda994d2b8f8a40872d98a1a61bcf671a94fb550ea58a20c677b3eb52be37853d860ed93a5d96b47b36be71dcad6d85d754eb66
SSDEEP

192:cDSmSTusK05zGwXwhJdlX3unYkvQhTuy8Fbxb93/a:6qr5zG2wTdhunYkvAuy8Fbf3/

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1448	4168	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 4168	2608	rundll32.exe	90
PID 2608 wrote to memory of 4168	2608	rundll32.exe	90
PID 2608 wrote to memory of 4168	2608	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#1
  2⤵
  PID:4168
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4168 -s 612
    3⤵
    - Program crash
    PID:1448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4168 -ip 4168
1⤵
PID:5076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4168-0-0x0000000075830000-0x000000007583C000-memory.dmp

Filesize
48KB

Download