94c70fd5da5feb18eb47c379083c68edb32ef7c35d97ee80bad5da8c00688600 | Triage

Analysis

max time kernel
55s
max time network
54s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
29/04/2024, 10:39

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/NewTextreplace.dll
Size

11KB
MD5

4c584ada75e66e2f3662f72c79b4bc26
SHA1

5ee7d2a0ed5662f0cda76a059234fe5f203a3b24
SHA256

2a770e400a83ce5220460d79f9e22236463c9972e2e32120f125a7d31761e302
SHA512

c6d7ea8d0e35084f23cd197b207cabe6625cc54d89efe6a8d016929d3bae3eb984342ce9b0e7f2c1e390c62aa4ba3cc2cfcbc40016d247244bd652ea46b2b75a
SSDEEP

192:tKUSemBDZGm2kaPKknekoGawkCOWf1QP8mnnL96h+/ii:7iAHd7WWq8mL9dii

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
756	616	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 616	1044	rundll32.exe	83
PID 1044 wrote to memory of 616	1044	rundll32.exe	83
PID 1044 wrote to memory of 616	1044	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NewTextreplace.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NewTextreplace.dll,#1
  2⤵
  PID:616
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 616 -s 600
    3⤵
    - Program crash
    PID:756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 616 -ip 616
1⤵
PID:4244

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/616-0-0x0000000064300000-0x000000006430A000-memory.dmp

Filesize
40KB

Download