241764aa9cf9c116450131ce70db7ed329ae98de464c0a6e473e1a39069c62a5 | Triage

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2024, 18:51

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/egvkdgg.dll
Size

170KB
MD5

14c8b2573e0b4e10a5aadc1949430c4b
SHA1

65e411d36481324896bc708880623ca1f04d1ef2
SHA256

169147eaec31b8b694e2e1cb7c391c294b788ad7c3b0c51a696326bb3d81189f
SHA512

9365ae078a5056c5dc425faa26f4c5edaea9bfc4413a9017dab2576a53b2fbb508f885bc0ff0380e49801ec8223d03cdac06dfc2a5fb7fafb87ae92e14cc8bca
SSDEEP

3072:G/Hrx5gOoG6gEOTdlTZxn9oHC81+0wG9zPac8:qr84Z2H/mGMc8

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2988	2276	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 2276	4916	rundll32.exe	86
PID 4916 wrote to memory of 2276	4916	rundll32.exe	86
PID 4916 wrote to memory of 2276	4916	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\egvkdgg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\egvkdgg.dll,#1
  2⤵
  PID:2276
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 600
    3⤵
    - Program crash
    PID:2988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2276 -ip 2276
1⤵
PID:3992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads