04f0dd6a18084c9bfb10d20346e3d8e2672bf9492d7143816cd15925a8f318d0 | Triage

Analysis

max time kernel
91s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
15-03-2024 23:31

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/razylfh.dll
Size

153KB
MD5

d5e4796f7bfec4f14ed59ca5f9df65fa
SHA1

e620857a03293928a04551d2ac9263296f9c0999
SHA256

bfa360e810448e0bd71e3e27b6d6d922e547f7cd5fa1f3c71db3778088f9aa61
SHA512

cd957fb9d65bdf64a8828e7da0fb67aa83c2cec23f7ae71f953c30822b66a6116dcc8883fada97943080dd09c08e6a7959fe62234002c4d959178661df24a2dd
SSDEEP

3072:G9sP0gEeGhEuaa6sjnWhIn4t52ELJ+PG/vsKO4HQi:/0gEL+Rt52ESG04HQi

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
220	1740	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 1740	4832	rundll32.exe	84
PID 4832 wrote to memory of 1740	4832	rundll32.exe	84
PID 4832 wrote to memory of 1740	4832	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\razylfh.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\razylfh.dll,#1
  2⤵
  PID:1740
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 600
    3⤵
    - Program crash
    PID:220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 1740 -ip 1740
1⤵
PID:2684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads