ab66ae9108ab3ef95667ab1cc8ba055e8f2e3a0e04424142d82ef79442884c74 | Triage

Analysis

max time kernel
33s
max time network
35s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 07:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/StartMenu.dll
Size

7KB
MD5

e98edd029f7f9f62ebb75992841817b8
SHA1

8a7054283e4386689a29c63f4e65f3ef1ea7c43f
SHA256

abf56fe9b605c8cd716a2cc59b6ef052428753d5c716aaf857c3349d74fae66c
SHA512

d6f3b151715a843a795f5a79931867031b2cc0c6406050f6af665fd07ba9d3b69557a09c720f88328b277fde0f47fffbb36a895196b7eb28d3c15ad0becc063a
SSDEEP

96:Z+dBC0x22epxPEvC4FkWE+in1/FMvsCGRfRFqCB5tlGhEl5VN:Z+/epxPE1r8/FtmCDtUg5v

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2136	2748	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 2748	2596	rundll32.exe	83
PID 2596 wrote to memory of 2748	2596	rundll32.exe	83
PID 2596 wrote to memory of 2748	2596	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#1
  2⤵
  PID:2748
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 612
    3⤵
    - Program crash
    PID:2136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2748 -ip 2748
1⤵
PID:3856

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads