1cb6977c6c4553ff7842af9205760e5c5958a85ffb3db2c1e94c69fcd0f0a347 | Triage

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-04-2024 08:42

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/StartMenu.dll
Size

7KB
MD5

72f18eaa88886bd0d46de64a17d9720c
SHA1

e604c84de0ded023cf4c5e215c0534faf1d18227
SHA256

05f699d932f1fea8e6f1a711c3bc8ba51463b924b78a68bfd0683295de008da1
SHA512

5a80e303f1418dde67ffe0b9b60d574b85634de0d2b557a6691229812e9b376fb34ba7e276efd0e20f35baec91f1030b738e2138d7b7ee146715fcab5cd7e018
SSDEEP

96:VgJbo7bG2VHk3C45rJixqE+6nSvMn0iGLG8wq/aAtJ1t2RhU1fU:qJk7ZHgRJRHvcwBwqP/t6wf

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2720 1156 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2072 wrote to memory of 1156	2072	rundll32.exe	rundll32.exe
PID 2072 wrote to memory of 1156	2072	rundll32.exe	rundll32.exe
PID 2072 wrote to memory of 1156	2072	rundll32.exe	rundll32.exe
PID 2072 wrote to memory of 1156	2072	rundll32.exe	rundll32.exe
PID 2072 wrote to memory of 1156	2072	rundll32.exe	rundll32.exe
PID 2072 wrote to memory of 1156	2072	rundll32.exe	rundll32.exe
PID 2072 wrote to memory of 1156	2072	rundll32.exe	rundll32.exe
PID 1156 wrote to memory of 2720	1156	rundll32.exe	WerFault.exe
PID 1156 wrote to memory of 2720	1156	rundll32.exe	WerFault.exe
PID 1156 wrote to memory of 2720	1156	rundll32.exe	WerFault.exe
PID 1156 wrote to memory of 2720	1156	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2072

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1156 -s 228
3⤵
- Program crash
PID:2720

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...