27694908dbdcf9b68fe26c65140c22da7068c2ebd154db13d2eb1571f9153ede | Triage

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 21:15

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/PPLMessageBox.dll
Size

45KB
MD5

b4198cb6e7271852d7b8b3260161a20b
SHA1

83f126b717389a51a4c4a4c6679043abad0d82ab
SHA256

40cb0cd0eb4067102f01bd6e6d0019b716ec0d0a470b12a9201cccd2488257f3
SHA512

6ea92ac39ad3bf36d7cc4c4ca2d0d3dc9aa4dc313a638c691f6b5da9c8c35057a49034ff2558d3cdde0fedee1612a5b7049f1f7be3172bf97c0f3415922f99cd
SSDEEP

768:UBjBr8enoRHWhXNYFYk3t2uda3CVLWQbC6:0Br8GoRHWhXiakouI3CVaEC6

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1680	776	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 776	2432	rundll32.exe	82
PID 2432 wrote to memory of 776	2432	rundll32.exe	82
PID 2432 wrote to memory of 776	2432	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\PPLMessageBox.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\PPLMessageBox.dll,#1
  2⤵
  PID:776
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 776 -s 632
    3⤵
    - Program crash
    PID:1680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 776 -ip 776
1⤵
PID:3436

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads