4fb3b4a9b098c5c60d7887df0598a6f98c61e90d4a9b2dec1220cbbfd9f2ccc0 | Triage

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/04/2024, 21:48

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/AccessControl.dll
Size

14KB
MD5

b9f48a4c97828f4db8a9b727d6df8dc7
SHA1

9ee2ac111560a5bb6e3377297dc93edb2f16ef8a
SHA256

273fe91103597f3ae0cd750e4b52bd83a9d582f90224d6e539e1a95a7481b71f
SHA512

6c8fc6372210da16fb5a2f88427b75eccdad3c8c930822f647245988d88ce34bde835fb1458415bdac297fda766bcf4d4e1feda00216a70bc0cfb44b75e1aa83
SSDEEP

192:TNzPKgdc4SN+XIjjAZaZp26N6dlJmclFFwmyywXhdMywUixm5:TNzPM0/aZUFFw1ysBZis

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3512	4692	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 4692	756	rundll32.exe	82
PID 756 wrote to memory of 4692	756	rundll32.exe	82
PID 756 wrote to memory of 4692	756	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\AccessControl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\AccessControl.dll,#1
  2⤵
  PID:4692
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4692 -s 612
    3⤵
    - Program crash
    PID:3512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4692 -ip 4692
1⤵
PID:3256

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads