c41ec3a9224a131c1e118fb6927ce73ad0c64bb66b727fe185f1eb114a8f8129 | Triage

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 14:46

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/inetcEXT.dll
Size

21KB
MD5

637d9bb78822a42ede890102065892ed
SHA1

6221e648833aaf3bf57915dd7fd811cedfcd81b0
SHA256

5303825e1eee6780cfc3571bb0705b5cf295a07cf34ab360db77d21a2dc0d722
SHA512

a1216ae15fce8e7bf99701cac145e3e036c6c03c8e38b1256610b6f43eb4d724225dc938cca26c3989cbdf14bb9450250beafb88687ac6215336937f6a99d456
SSDEEP

384:qolst5Gsi/Vne0sCl3AREGraXLyk4UX0Ac9khYLMkIX0+GR9yjn:qow5UVnzBAdk+k4U

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
384	2420	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 2420	1512	rundll32.exe	83
PID 1512 wrote to memory of 2420	1512	rundll32.exe	83
PID 1512 wrote to memory of 2420	1512	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\inetcEXT.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\inetcEXT.dll,#1
  2⤵
  PID:2420
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 624
    3⤵
    - Program crash
    PID:384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2420 -ip 2420
1⤵
PID:4344

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads