80d28b14d2172c2a3a76a718b604d120ff2a8e80424d68790afbe0bd267ee064 | Triage

Analysis

max time kernel
136s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
06-05-2024 03:13

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/ExProcDLL.dll
Size

55KB
MD5

87495320b6bc4f54d129561d5a6011d9
SHA1

7c44a32a778483b8e807ab04863096648e4d73d5
SHA256

918625e67a13292ef53cdb807f39dc52dc98614c5add967cd65516bf6e50ad44
SHA512

7fafc35a6098ab3ca3aec144b25ed0e6d6c9df6fda8b92007be3332a6297f69126b33b52969567006e5c32f21f8507f39f7e7f48dc3edf5f585c9eeddd85ee3e
SSDEEP

768:A+E6M3ijAdUxvC4qVbcJCqZ3wNwYOA1ZmlqYO:A/xijAd+C4qVRk3wNFOAPmlF

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1928 4436 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1864 wrote to memory of 4436	1864	rundll32.exe	rundll32.exe
PID 1864 wrote to memory of 4436	1864	rundll32.exe	rundll32.exe
PID 1864 wrote to memory of 4436	1864	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ExProcDLL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1864

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ExProcDLL.dll,#1
2⤵
PID:4436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4436 -s 632
3⤵
- Program crash
PID:1928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4436 -ip 4436
1⤵
PID:4368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...