2479679e552f97a643b5c3781fe03c47db757759c4c1eab313dcb41858577463 | Triage

Analysis

max time kernel
130s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2024, 02:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/System.dll
Size

16KB
MD5

991d09235944414ae51be4dd7611f7f7
SHA1

b34d6b0ccb1013ddb5c2eb80f02b03a2b893911b
SHA256

3f13314bb93a92748e3a08f47e23b3206196a6c7e59f7aee3382a601b8c3e366
SHA512

63ccdb59b7f7a940bd93fb0a4f9cf3c15a25e4a7ee0468d6c2072ebbfebe23d3a21f11148587c904acf58064ed576f460beeb90fac5af79235624b1679c4da38
SSDEEP

384:Ga1UTL7ppMMq5hyp/mTsfTFALDiCcX2Ql:Gn85c8QLuOCcX2

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1980	1536	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 1536	4884	rundll32.exe	83
PID 4884 wrote to memory of 1536	4884	rundll32.exe	83
PID 4884 wrote to memory of 1536	4884	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
  2⤵
  PID:1536
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 612
    3⤵
    - Program crash
    PID:1980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1536 -ip 1536
1⤵
PID:3220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1536-0-0x000000006E3C0000-0x000000006E3CA000-memory.dmp

Filesize
40KB

Download