8244d3c049d38b92198166cd4f16d6a77f67c731fd157683c25decf4e699867e | Triage

Analysis

max time kernel
88s
max time network
205s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
16-04-2024 19:36

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/linker.dll
Size

7KB
MD5

4e944d80e84525628c17a3a180032aa2
SHA1

e3c60df479140729c4f22791fddc70d96f151d96
SHA256

0503059d7fdcc3f9dc3d03fbd09b69005caaeb697d3ba1aadfd7be3af1f99874
SHA512

1d6dc455b0f6cbd1f4f4a01d3bfad4e21a09b5f83377e63318fb1379fea5545b4401bb80613f58b05237fbff61a43d1413e83747f62c84c6cf25ccbf05ad02dc
SSDEEP

96:efJl0ef3f8syw4CIXdpWODGQEkTyf36qtHbk3gvOa:eBl0cP85ftpWG9EkqttHbLvr

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4104	4996	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3800 wrote to memory of 4996	3800	rundll32.exe	80
PID 3800 wrote to memory of 4996	3800	rundll32.exe	80
PID 3800 wrote to memory of 4996	3800	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\linker.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3800
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\linker.dll,#1
  2⤵
  PID:4996
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4996 -s 504
    3⤵
    - Program crash
    PID:4104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4996 -ip 4996
1⤵
PID:404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads