4fb3b4a9b098c5c60d7887df0598a6f98c61e90d4a9b2dec1220cbbfd9f2ccc0 | Triage

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/04/2024, 21:48

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/DcryptDll.dll
Size

18KB
MD5

d49384b11614f78df95b05e86b19190b
SHA1

b6ae79b295ac6549ff4bd733569a04f55a904df0
SHA256

538e08248e631f53784aa40ecbaa82f6968a516180f3c24647e1db74efe1b1d8
SHA512

588bb9cb77d69e4e7cbb28093a975d6fabffd13bf350eb781b339d94be16882ad884c619a537b1e811878213827322588468a6227a94e2afa83483f7e0173652
SSDEEP

384:2ZyQSewDbPmRqcXx2kMPrd9cbkUmR08EMZ6:2btwnmR/xQdckUSEMZ6

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4936	412	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 496 wrote to memory of 412	496	rundll32.exe	85
PID 496 wrote to memory of 412	496	rundll32.exe	85
PID 496 wrote to memory of 412	496	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\DcryptDll.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:496
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\DcryptDll.dll,#1
  2⤵
  PID:412
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 412 -s 608
    3⤵
    - Program crash
    PID:4936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 412 -ip 412
1⤵
PID:3620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads