e5a4f00a5050fd2f029b4bacba9fc79c65e8f74809ee53eda02e2059352811d7 | Triage

Analysis

max time kernel
142s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
11-04-2024 00:59

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/StartMenu.dll
Size

8KB
MD5

be6fb713850c99b7cb365269779b7e70
SHA1

9e4eea2899afb5de0369ac1010d9e97c3a7d2bef
SHA256

0196ce26fc92791b88305cc4bd1d2838fd5c63abae21612423c80345e2c7b59e
SHA512

27c4c6382fa01e94d95cdd2892773d525bc328f4589ac251b1c90869a884a6f7514e2b638ff6b998d82979f9a4e7f99617853d48bf415749058482d42df529c7
SSDEEP

96:60chlULaycj0lhQt14glcjkAJ7uP2uPbsxwHoePRpfb:lvc11rc75VxMoI3f

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3460	4616	WerFault.exe	94

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4528 wrote to memory of 4616	4528	rundll32.exe	94
PID 4528 wrote to memory of 4616	4528	rundll32.exe	94
PID 4528 wrote to memory of 4616	4528	rundll32.exe	94

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#1
  2⤵
  PID:4616
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 612
    3⤵
    - Program crash
    PID:3460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4616 -ip 4616
1⤵
PID:3296

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4252 --field-trial-handle=2224,i,17688331074622862378,73816879873678745,262144 --variations-seed-version /prefetch:8
1⤵
PID:3260

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4616-0-0x000000006D040000-0x000000006D049000-memory.dmp

Filesize
36KB

Download