ec4a958ab73fa233b4bb5cbaf68ea3486384997d53740bfa9c3307ce150a59dd | Triage

Analysis

max time kernel
67s
max time network
54s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 14:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/SimpleSC.dll
Size

70KB
MD5

4a2b58bd7cab29463d9e53fcb9a252b6
SHA1

4679ba66db7989a64c41892bbb3f7cec38fb5597
SHA256

18b17999996d73fe911a8eb676c231cb0bf002174954b552f880bdabf4c78124
SHA512

e6a69b5bb52467e7b8168a3e0ad45252b196b8eaea87b91f8d3b150545ce6bc7ee586ebe1d83da6c04203a9a9bab5f4af66759ba35b73306f7962ca5b6ff2fff
SSDEEP

1536:p/qXv1si+Xsp9MNptZ8KMT6+nMA4fx+kmA/11HWXiZ:Qv1EXZnLMT5M3x+kmu3Hgy

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2196	4424	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4536 wrote to memory of 4424	4536	rundll32.exe	84
PID 4536 wrote to memory of 4424	4536	rundll32.exe	84
PID 4536 wrote to memory of 4424	4536	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SimpleSC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SimpleSC.dll,#1
  2⤵
  PID:4424
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4424 -s 620
    3⤵
    - Program crash
    PID:2196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4424 -ip 4424
1⤵
PID:5056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4424-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download