5252e00d2dc0fa62fb4a3721826acb9b8c8198f5734003cca85887bfa2ec56f9 | Triage

Analysis

max time kernel
93s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2024, 09:58

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/ipinfo.dll
Size

20KB
MD5

07a769c1c545256232619eb595139750
SHA1

55c180cf3271d850f145e045554fb8e3f10c9a22
SHA256

7487b1a4cf93ea7ba80d8926614254b8ebb483517d916094edcfd19a4a691fa9
SHA512

cd86ce1189ea17e6651be1e165ec2f2fda6838d96f89126607ab165789e0231a52739ab052de63b73ce78312dc1edd777b798b148b6bbfa3f6532d40e26646aa
SSDEEP

384:WVq8HOWJUnRr82MmeIBaekVZhJcuCXzCQxLlLNjxax3UTc77:WI8J+iekHhauCX+QxZLihUI

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3024	2256	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 452 wrote to memory of 2256	452	rundll32.exe	85
PID 452 wrote to memory of 2256	452	rundll32.exe	85
PID 452 wrote to memory of 2256	452	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ipinfo.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:452
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ipinfo.dll,#1
  2⤵
  PID:2256
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 612
    3⤵
    - Program crash
    PID:3024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2256 -ip 2256
1⤵
PID:8

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads