0e804ac647cbc564b48009e8e9162b6ad857ed3e74e8893f3bd32624c1ac5d58 | Triage

Analysis

max time kernel
129s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2024, 03:23

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/gnumhdu.dll
Size

158KB
MD5

08be5628b02c48eca543addcdddbb675
SHA1

d639ad7383fab427e914201fe7ef9b31703732f6
SHA256

e46dcf3c71ad231a37a441a55665b543e7828bd7bb113899b00d893423ef6ff0
SHA512

f7948f5ae1d9749abebcf5e20e44689bcdc721e7ce0249c3dcd2e4e2ee35bbc6d1529f404aa1809aad4cf38518c256c0b9d2981956dbe7d56237baa232c20a8e
SSDEEP

3072:kCI3EaRcGg3LfzhuuP0UU1+ZWLYluDg6Sp7d:kCVz370UmrLM7

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4312	412	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 412	4904	rundll32.exe	84
PID 4904 wrote to memory of 412	4904	rundll32.exe	84
PID 4904 wrote to memory of 412	4904	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\gnumhdu.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\gnumhdu.dll,#1
  2⤵
  PID:412
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 412 -s 600
    3⤵
    - Program crash
    PID:4312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 412 -ip 412
1⤵
PID:1388

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads