a6eb7a7372c462b2e181014540491a062c540edc4ba0f65a9169cfbfb473e6c7 | Triage

Analysis

max time kernel
89s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 07:17

Sharing

Report Analysis Logs

General

Target

bin/uactmon.dll
Size

146KB
MD5

ffae295cc48606ba15fd9ac07c0c112f
SHA1

8c6f34204f8ac213b0fb90aa51ab21d52cbbbc29
SHA256

fad77b24478f5ec8aa7f6018e000cf504d6227fe217d1543d4b4cbe5f8a3b1ac
SHA512

ef4fcb39e9acabf7ebfd03249b99944e75331becd178b969ac9e12fbd94e8c123925a8a916166583f05e7dc5bbc4e0bd16e67d6e6a417d033349646b6c047e8e
SSDEEP

3072:L02zbMmVhON4Lk6EJiiV9RiItvpCpDuL/l5uoHm:Ln3MqIN4MVHiqsJuL/9Hm

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4556	2100	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 2100	1464	rundll32.exe	86
PID 1464 wrote to memory of 2100	1464	rundll32.exe	86
PID 1464 wrote to memory of 2100	1464	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\uactmon.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\uactmon.dll,#1
  2⤵
  PID:2100
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 612
    3⤵
    - Program crash
    PID:4556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2100 -ip 2100
1⤵
PID:1276

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads