ec4a958ab73fa233b4bb5cbaf68ea3486384997d53740bfa9c3307ce150a59dd | Triage

Analysis

max time kernel
135s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 14:16

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/SysRestore.dll
Size

14KB
MD5

54630ddb77ed9a17110d955458b6b0f0
SHA1

7c80960cdeba57d3325e7894f2126b12f2ad38c8
SHA256

c470b78687c1134007977b9025ef8481ad6ffe163c8afcc5c1810df03e93c306
SHA512

475fef9ccc483eaa1ec0913a8235aff12bc3a3ac9eb93c595a9046ce6409824c9f990e30582d54ba0f423355db4535816ee046f5f50ed2e8f069aa5b9b78ee9f
SSDEEP

384:0k1IeZDcLI84pj8vlHith5kC+2GNGb5hiX8ZpH6Ay:0k1VksEtifriXiR+

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
320	1108	WerFault.exe	91

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4236 wrote to memory of 1108	4236	rundll32.exe	91
PID 4236 wrote to memory of 1108	4236	rundll32.exe	91
PID 4236 wrote to memory of 1108	4236	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SysRestore.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SysRestore.dll,#1
  2⤵
  PID:1108
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 600
    3⤵
    - Program crash
    PID:320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1108 -ip 1108
1⤵
PID:5060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4796 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:8
1⤵
PID:1368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads