ec60beee43104003bc410371ae1ef8e846e17ff5733556dbd8e7acae68058200 | Triage

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
26-04-2024 15:35

Sharing

Report Analysis Logs

General

Target

bin/plds4.dll
Size

11KB
MD5

b7ed50495d311cf6e7ad247968dd2079
SHA1

3364725821ea012f8fa99df102677befc5ff929f
SHA256

20166e281b31ae60672b9d87cb69fcba0c38cc5e18a8ba081c5601ccfab7589f
SHA512

a783f0a00d016a5974f87399637bddd5a5821e3a79c5acb2f6b3f097c9bffefb8a1dee7d968c0646faa2d854a105c57988d244d9c47fb9c189d8383c00a8d2fe
SSDEEP

192:PMf3jwDmDS5J3HcLK9gRIcsumHu4BGeTNN+b9omw5TYlFQ3XGU0r3zqY:PMkDmS5ZcLK9gufNBdxl9klFwH0r35

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1756	1336	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 1336	1276	rundll32.exe	28
PID 1276 wrote to memory of 1336	1276	rundll32.exe	28
PID 1276 wrote to memory of 1336	1276	rundll32.exe	28
PID 1276 wrote to memory of 1336	1276	rundll32.exe	28
PID 1276 wrote to memory of 1336	1276	rundll32.exe	28
PID 1276 wrote to memory of 1336	1276	rundll32.exe	28
PID 1276 wrote to memory of 1336	1276	rundll32.exe	28
PID 1336 wrote to memory of 1756	1336	rundll32.exe	29
PID 1336 wrote to memory of 1756	1336	rundll32.exe	29
PID 1336 wrote to memory of 1756	1336	rundll32.exe	29
PID 1336 wrote to memory of 1756	1336	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\plds4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\plds4.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1336
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 228
    3⤵
    - Program crash
    PID:1756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads