224b71ec0d41758f1a83d8cb988bed9a39c547263fc51bf78bb1657972bf5c76 | Triage

Analysis

max time kernel
67s
max time network
50s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 10:30

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/egvkdgg.dll
Size

170KB
MD5

14c8b2573e0b4e10a5aadc1949430c4b
SHA1

65e411d36481324896bc708880623ca1f04d1ef2
SHA256

169147eaec31b8b694e2e1cb7c391c294b788ad7c3b0c51a696326bb3d81189f
SHA512

9365ae078a5056c5dc425faa26f4c5edaea9bfc4413a9017dab2576a53b2fbb508f885bc0ff0380e49801ec8223d03cdac06dfc2a5fb7fafb87ae92e14cc8bca
SSDEEP

3072:G/Hrx5gOoG6gEOTdlTZxn9oHC81+0wG9zPac8:qr84Z2H/mGMc8

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4244	4440	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1436 wrote to memory of 4440	1436	rundll32.exe	84
PID 1436 wrote to memory of 4440	1436	rundll32.exe	84
PID 1436 wrote to memory of 4440	1436	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\egvkdgg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\egvkdgg.dll,#1
  2⤵
  PID:4440
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 600
    3⤵
    - Program crash
    PID:4244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4440 -ip 4440
1⤵
PID:2592

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads