90263f5e0ceee73af6ee6ca4dac8e6441c1f5c39607512a954e42887a5a0bb3a | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 10:42

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/System.dll
Size

11KB
MD5

7399323923e3946fe9140132ac388132
SHA1

728257d06c452449b1241769b459f091aabcffc5
SHA256

5a1c20a3e2e2eb182976977669f2c5d9f3104477e98f74d69d2434e79b92fdc3
SHA512

d6f28ba761351f374ae007c780be27758aea7b9f998e2a88a542eede459d18700adffe71abcb52b8a8c00695efb7ccc280175b5eeb57ca9a645542edfabb64f1
SSDEEP

192:eF2HS5ih/7i00dWz9T7PH6lOFcQMI5+Vw+bPFomi7dJWsP:rSUmlw9T7DmnI5+N273FP

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

308 820 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2320 wrote to memory of 820	2320	rundll32.exe	rundll32.exe
PID 2320 wrote to memory of 820	2320	rundll32.exe	rundll32.exe
PID 2320 wrote to memory of 820	2320	rundll32.exe	rundll32.exe
PID 2320 wrote to memory of 820	2320	rundll32.exe	rundll32.exe
PID 2320 wrote to memory of 820	2320	rundll32.exe	rundll32.exe
PID 2320 wrote to memory of 820	2320	rundll32.exe	rundll32.exe
PID 2320 wrote to memory of 820	2320	rundll32.exe	rundll32.exe
PID 820 wrote to memory of 308	820	rundll32.exe	WerFault.exe
PID 820 wrote to memory of 308	820	rundll32.exe	WerFault.exe
PID 820 wrote to memory of 308	820	rundll32.exe	WerFault.exe
PID 820 wrote to memory of 308	820	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2320

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 820 -s 224
3⤵
- Program crash
PID:308

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...