cf1df17c2105cf334c8e66dea374d34639ada4d4f51492a30901ab60591567ab | Triage

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2024, 15:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/AdvSplash.dll
Size

6KB
MD5

ca5bc3627eced1e65e92bc681d1dd428
SHA1

5fb30cd6afcce2377feaed143debac138007d4e4
SHA256

eb23e2436003fbaba5b08d441f98560c7f26bd25ba21910fb8f7446832bf3e32
SHA512

eca6959adbf0a32015b38979e125f5812e1baa9d40e807993326a5bb362d6b42496510a467da99c38c5f266f2bb0705c3506b2979427e817651f04792f6e0a23
SSDEEP

96:BQNyX2PtUZsM88eo93NaqqhN51xWabkkEkk/StC1woo:BFXYt38B9V61dk/kkStC1

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2992	1120	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 1120	1588	rundll32.exe	88
PID 1588 wrote to memory of 1120	1588	rundll32.exe	88
PID 1588 wrote to memory of 1120	1588	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\AdvSplash.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\AdvSplash.dll,#1
  2⤵
  PID:1120
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1120 -s 616
    3⤵
    - Program crash
    PID:2992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1120 -ip 1120
1⤵
PID:2284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads