5cfaec15d48d36b15ac725930e3203e30e40bf17fc0d11de83d5e4f42a0f717c | Triage

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2024, 15:06

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/CabDLL.dll
Size

80KB
MD5

3b8cf4f6c883c7ca0c964ef2a96525aa
SHA1

7f0d1b89783056decea951fa7b25d3c4c354d0d3
SHA256

58b29737613b3b916ae6d8ad12790da5cffcf0f354739abfa41bab60a80d40ea
SHA512

6474c7a8fb31c0e1cdbb4fbc5653a060961557565484ee2d26beb8be0e5d047790f8ff96710729bf5ee9eb00011beb98c370eb2ae01aa4ad0971f58910ebcd24
SSDEEP

1536:CAecLfUiFF6h/q6krEnJfSh5iOqML8CNajobjkR3t5r:C+MiFMh/q6krEnY4MAC0jo83t5r

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5032	1736	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3432 wrote to memory of 1736	3432	rundll32.exe	88
PID 3432 wrote to memory of 1736	3432	rundll32.exe	88
PID 3432 wrote to memory of 1736	3432	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\CabDLL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3432
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\CabDLL.dll,#1
  2⤵
  PID:1736
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 608
    3⤵
    - Program crash
    PID:5032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1736 -ip 1736
1⤵
PID:3160

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads