ec60beee43104003bc410371ae1ef8e846e17ff5733556dbd8e7acae68058200 | Triage

Analysis

max time kernel
54s
max time network
56s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 15:35

Sharing

Report Analysis Logs

General

Target

bin/plds4.dll
Size

11KB
MD5

b7ed50495d311cf6e7ad247968dd2079
SHA1

3364725821ea012f8fa99df102677befc5ff929f
SHA256

20166e281b31ae60672b9d87cb69fcba0c38cc5e18a8ba081c5601ccfab7589f
SHA512

a783f0a00d016a5974f87399637bddd5a5821e3a79c5acb2f6b3f097c9bffefb8a1dee7d968c0646faa2d854a105c57988d244d9c47fb9c189d8383c00a8d2fe
SSDEEP

192:PMf3jwDmDS5J3HcLK9gRIcsumHu4BGeTNN+b9omw5TYlFQ3XGU0r3zqY:PMkDmS5ZcLK9gufNBdxl9klFwH0r35

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4368	2024	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3576 wrote to memory of 2024	3576	rundll32.exe	83
PID 3576 wrote to memory of 2024	3576	rundll32.exe	83
PID 3576 wrote to memory of 2024	3576	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\plds4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3576
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\plds4.dll,#1
  2⤵
  PID:2024
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 640
    3⤵
    - Program crash
    PID:4368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2024 -ip 2024
1⤵
PID:60

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads