04f4df9c0bedc9eb294ee90f4e3efb12b926c70821b9cfc5e5514119b3a73ed2 | Triage

Analysis

max time kernel
125s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 21:41

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/ngrpgnd.dll
Size

153KB
MD5

0b0a2b991c9f13610c66607a796dccfa
SHA1

651a968a6564db5ad0f83e9a498dd7e2dbddea1c
SHA256

73db2eb2613de0629f87ea193aa5f604591d22e0c8f2029662ed462be4548f77
SHA512

0a3597f61dd1d94b9f3caafce5de2535036edc39afcc6aa5b0b1f45d615df47181535168266d33fd8d4b2e3547e5c6009010cb794d2aaa9f0f1d891e60f7cf16
SSDEEP

3072:5fCe6B6jbp4UzMEDcMe7BzYFVT+0VE2EAsIT7ka:5fCFsb2FBzYnr6lIT7

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3580	2300	WerFault.exe	91

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 2300	4868	rundll32.exe	91
PID 4868 wrote to memory of 2300	4868	rundll32.exe	91
PID 4868 wrote to memory of 2300	4868	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ngrpgnd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ngrpgnd.dll,#1
  2⤵
  PID:2300
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 600
    3⤵
    - Program crash
    PID:3580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2300 -ip 2300
1⤵
PID:4864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4116,i,11266875042087428226,16669718873272757238,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:8
1⤵
PID:3084

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads