469c034a1b0db632b355417177df3872abd056bd300ac457fae4ed4d9cb2ce8b | Triage

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27-03-2024 16:06

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/ExLicenseIDBoanPage.dll
Size

44KB
MD5

96869afd6fae4c8ccb0c56996b8fae8d
SHA1

e9f4d80f61521b03d0c07d9abe3a00ff461de40b
SHA256

94bc2f57d978a4027c32595a1a3c5ed20f83d689646f254a4b2a5b815cee59d1
SHA512

12dacdab1e73e827f9507eaa963a012fa66a63b5a531e09f0bd84c4d81787e1777b347e325b6b4ae9fa11555ee390312173bc292860f6e234ecf3835a6a37b11
SSDEEP

384:Sum13eB6kWUnHOII9p8+6P95H282nv2JKiXn5IODyOx:Zkm6kxHOIIT8LWqHWO

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2072	3832	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3972 wrote to memory of 3832	3972	rundll32.exe	87
PID 3972 wrote to memory of 3832	3972	rundll32.exe	87
PID 3972 wrote to memory of 3832	3972	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ExLicenseIDBoanPage.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ExLicenseIDBoanPage.dll,#1
  2⤵
  PID:3832
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3832 -s 624
    3⤵
    - Program crash
    PID:2072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3832 -ip 3832
1⤵
PID:556

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads