3e99395c5a6bce5bd7fc497c7ceac1398e2e2cf3ff490b0b08b0a850f6d036d7 | Triage

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16/03/2024, 01:09

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/ceasszt.dll
Size

153KB
MD5

c942f1029ebc7b3c037d4c8ea537c490
SHA1

683da5f8b3687ae1f112c23476759f6f921059d3
SHA256

6b0b502278a56f0a36ff8015f0d99b261f35a57b7e54d96888258740233b87cc
SHA512

8d34f31e9d2b09f4dda7fdf062f0c8dd06a03243bc1f6ac9ac854c429866d4ab4512e2c46f61508bce8d39ec7284f21d4053e6794d3fa5a088f334960dafdf0c
SSDEEP

3072:GasvJni/O4CZGams4nWhIn1IB9FO++GG/HsOORHQi:qhiWQ5IB9bDGURHQi

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2944	1592	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 1592	2532	rundll32.exe	89
PID 2532 wrote to memory of 1592	2532	rundll32.exe	89
PID 2532 wrote to memory of 1592	2532	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ceasszt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ceasszt.dll,#1
  2⤵
  PID:1592
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1592 -s 600
    3⤵
    - Program crash
    PID:2944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1592 -ip 1592
1⤵
PID:3000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads