cf1df17c2105cf334c8e66dea374d34639ada4d4f51492a30901ab60591567ab | Triage

Analysis

max time kernel
141s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2024, 15:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/StartMenu.dll
Size

6KB
MD5

4221b986a7f977d3658b7ed994762796
SHA1

2d1455a73653e0449de7aa39a2d4c9bd5be8d2f7
SHA256

a7f9f6427cb8ecb308dfd2ac622168b73a605614a83b7a9f6e3d416e7e9061c8
SHA512

e37415ae4166c99995999cceefe2cade1c9f4e7950d61231acfd220fe30eabec4208ba2d2fcd4e363d2f5fcf84af127291412710f3767dfd29e25cfa4e571f09
SSDEEP

96:oLJdRZk8OkmE+WHw0FMXF6CWhFxKpKscQhEfP0:oLjPk8OT30FFAdCP0

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2656	2088	WerFault.exe	94

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 548 wrote to memory of 2088	548	rundll32.exe	94
PID 548 wrote to memory of 2088	548	rundll32.exe	94
PID 548 wrote to memory of 2088	548	rundll32.exe	94

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#1
  2⤵
  PID:2088
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2088 -s 600
    3⤵
    - Program crash
    PID:2656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2088 -ip 2088
1⤵
PID:2512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4312 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
1⤵
PID:3080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads