d4b30c1f2c1f10f46037533e5768b6abba1f60a613e779d871c21abe8ef02d48 | Triage

Analysis

max time kernel
142s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 19:59

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/StartMenu.dll
Size

11KB
MD5

3e60c0b440b1ecc21d956e83bcba0976
SHA1

8fc85b2d7b4192105afc73dec15d49280345e474
SHA256

135e5a8272b9732d4b9a798b29adf953b4fe4e802b3f6178896ada530d4ecdfb
SHA512

57c879668f28d29d45b91538e27fafa9628881e1423673402579cf670a5a3fdc3b03abb19feea3655969ce8789e18f70508a78d26174add767738821557a8354
SSDEEP

192:JLB7OopThbgh9Yoo6sHUzKXW1kOUBo5Boz9c:JLB77p6h91s0zKGWfc

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2392	2356	rundll32.exe	28
PID 2356 wrote to memory of 2392	2356	rundll32.exe	28
PID 2356 wrote to memory of 2392	2356	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2356 -s 144
  2⤵
  PID:2392

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2356-0-0x000007FEFBE90000-0x000007FEFBE9D000-memory.dmp

Filesize
52KB

Download