f4ed82101d7f7ba519079ea91d3a4c18d974d72ccc0dd63747c33b0aeedb82b9 | Triage

Analysis

max time kernel
120s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
13/04/2024, 03:16

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/CallAnsiPlugin.dll
Size

3KB
MD5

c8ff7c87b591958cb1970a7d89b9839f
SHA1

9d34a40b574eabd6bd321c976a13ab0f4d0ef236
SHA256

2703314a0d03377c6774dad865c292d4808bc4f748871f16f142c09527c5e617
SHA512

30a0cbefced3d1d044067e188fedb1137b1734c237ed9ffe52c009c46600ec081610e2e861074eacd5bb6252e20136bd13a800ce5704b39d2978571766dec13f

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
368	4484	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 4484	1556	rundll32.exe	79
PID 1556 wrote to memory of 4484	1556	rundll32.exe	79
PID 1556 wrote to memory of 4484	1556	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\CallAnsiPlugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\CallAnsiPlugin.dll,#1
  2⤵
  PID:4484
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 600
    3⤵
    - Program crash
    PID:368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4484 -ip 4484
1⤵
PID:1832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads