75ff6072436c6bf42b8bac92bdb5127f2000032d856b0a67266048cc090ef11a | Triage

Analysis

max time kernel
67s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27-04-2024 22:10

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/ihctsns.dll
Size

166KB
MD5

9915ed630811790c76c5f9498b982f6a
SHA1

3eee156a20836066056d4dfdd8e320ce524e53e1
SHA256

7203d9a21f1d5abab705f3d42f2b64c887b5355fd9e3b28e3e6dd16d67ade8b1
SHA512

a9581cf3ba9800c6508d77603bdd27cbb6b0021c8423df078912fb6107f4f9914b53e666e97616039be8bda21789fc02c944390fe7700894d5348cc770d3016d
SSDEEP

3072:GtgbOzZITn1iqap0/KTgl5sdMldwTro+qe9spY6al:egbOzS71iPslddwTM27l

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4572 4428 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4876 wrote to memory of 4428	4876	rundll32.exe	rundll32.exe
PID 4876 wrote to memory of 4428	4876	rundll32.exe	rundll32.exe
PID 4876 wrote to memory of 4428	4876	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ihctsns.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ihctsns.dll,#1
  2⤵
  PID:4428
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4428 -s 600
    3⤵
    - Program crash
    PID:4572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4428 -ip 4428
1⤵
PID:4956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads