284a18ed393b0e60ca6fada933c6612df9862d024038c51a0ab8906ccbdcc990 | Triage

Analysis

max time kernel
130s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08-05-2024 07:47

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/Internet.dll
Size

10KB
MD5

d4d774e8cf4c2dc669f4f2003334ccf4
SHA1

3759ad7e7195c40836e4a465b2db7749673a5a1d
SHA256

04c22ec18d614a76181709482a7307b2e59d4c45f42bf1f6313a974982e519be
SHA512

bb4898a1c457faf8b7a711c6040c959b1d8361b4dab758283c1f531d4155803f2a6fa3bd57cf8490cbec98499738deaa830dc44e0067d3da8970e34bee2d453e
SSDEEP

192:PLfR+vHCJ1oKnYe+PjPSrcy++v1Etr9ZCspE+TMQrFW:FmCznYPLltAeMh

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3604	2468	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 2468	2968	rundll32.exe	85
PID 2968 wrote to memory of 2468	2968	rundll32.exe	85
PID 2968 wrote to memory of 2468	2968	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Internet.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Internet.dll,#1
  2⤵
  PID:2468
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2468 -s 624
    3⤵
    - Program crash
    PID:3604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2468 -ip 2468
1⤵
PID:3432

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads