921dbe0de51c231d0612cb5317df7491bbcf2f5d8c348e747c846316ec80f72b | Triage

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 02:11

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/FontName.dll
Size

8KB
MD5

80fc669a19766341bf93e0814f206b07
SHA1

f9ee3008abbf5d154dd705b20a5df274e78d320d
SHA256

6f199ea45550e187d89dde24ec23fa64897c876abe98dec33d7b78363dd87ebc
SHA512

02ee16524db98314c082f7098e3f56ed8546885f663a34b142a84442a7c08beb17ab9688a4b5bc05109284732c1db5db381b27ad63ef6d89e8aef5a31c732c0e
SSDEEP

192:skXmDSN0DcNMrHuH5ZrmrK0ATftcYnXS:xwSAIAATVcYXS

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1836	3028	WerFault.exe	91

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 3028	5068	rundll32.exe	91
PID 5068 wrote to memory of 3028	5068	rundll32.exe	91
PID 5068 wrote to memory of 3028	5068	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\FontName.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\FontName.dll,#1
  2⤵
  PID:3028
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 604
    3⤵
    - Program crash
    PID:1836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3028 -ip 3028
1⤵
PID:1348

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads