d4b30c1f2c1f10f46037533e5768b6abba1f60a613e779d871c21abe8ef02d48 | Triage

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 19:59

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/UserInfo.dll
Size

7KB
MD5

8e1998776ffd1d578a80d603c55721fc
SHA1

48ff2d677739d0f34f6c8cda41258af3989f534d
SHA256

7616de346ee28e4314d8a5bf67575c0010b1b07c93c6c29798f9106589ba25ae
SHA512

90c0800e485bd56177576b1d245457427d15b81b475eca4154a65225b82fe9c2ae7f07b07d48a61a3f622c4b2a2cb0b834a5d0b0b895f5bbf88b5bdead2257eb
SSDEEP

96:CMa252x1kO2TPrdKXW3xOgHdjOC2gwNQtyrdUyJx1XW:go7DJKXWDSpJ

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 2224	1712	rundll32.exe	28
PID 1712 wrote to memory of 2224	1712	rundll32.exe	28
PID 1712 wrote to memory of 2224	1712	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UserInfo.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1712 -s 88
  2⤵
  PID:2224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1712-0-0x000007FEFB3E0000-0x000007FEFB3E9000-memory.dmp

Filesize
36KB

Download