1111b6c0549732eeea9845ed57c1e98f2bf6a6890bbd7e93e403a2251f9c191f | Triage

Analysis

max time kernel
92s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 21:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/keygf.dll
Size

152KB
MD5

6ebdc0ab6bb0614c3a4bf8b6895330cc
SHA1

070967f02d287c596923514bf7d4a92fa435200c
SHA256

3e0cfb986e3a078cbd5696192f73b8dd47842511bb92eef1f7753621dfd1f3e2
SHA512

08eeac8528cf38b1c6003c1b7fc05fa237d42733d23ee93864bdc661fa6f779dad3d290a39a4675511c499780299e798c0a0656f586e636de3a2a4b431d012d7
SSDEEP

3072:GCOFODlkA1BfNUwFQ6926Jo+OG/8ssyKJ5:qFmNQ69joLGBm

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5012	4888	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 4888	1836	rundll32.exe	79
PID 1836 wrote to memory of 4888	1836	rundll32.exe	79
PID 1836 wrote to memory of 4888	1836	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\keygf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1836
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\keygf.dll,#1
  2⤵
  PID:4888
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4888 -s 600
    3⤵
    - Program crash
    PID:5012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4888 -ip 4888
1⤵
PID:4556

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads