9df5b721c2d81e174c49a5f39be74fe761d0403e184a2f2a079aca427f2e0124 | Triage

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02-05-2024 05:19

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/Convert.dll
Size

113KB
MD5

27ad43a37566f883c2a95f773dd3b6f5
SHA1

0c5ab78b2fc5de9b789c0051b2eb5b3f82b83af1
SHA256

acaae5a76974ca7f8d7544104fb8398c4075baed7920e356988ef177055a905f
SHA512

4397842f5162a19aa420d7cd0c299896d78d4d8ab90044c10e3aee234fc5b787b399bff286ac9cca693e99f4170cafb36cb00f646869ab949d2854cb8ec72d4d
SSDEEP

1536:Txzd/P79Tzw2DtmHY72aD8c8ngWnij1/O1n+mW8Bf4FUImE:9BBUBHyuc8gjin+t8BwFUbE

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1788	1880	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 1880	1088	rundll32.exe	82
PID 1088 wrote to memory of 1880	1088	rundll32.exe	82
PID 1088 wrote to memory of 1880	1088	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Convert.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Convert.dll,#1
  2⤵
  PID:1880
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1880 -s 600
    3⤵
    - Program crash
    PID:1788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1880 -ip 1880
1⤵
PID:1288

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads