c37ac379f7614de0382c60dee8470067c15397a0679cff1f6e4b7f6b40f029b6 | Triage

Analysis

max time kernel
132s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2024 18:08

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/advsplash.dll
Size

6KB
MD5

505c7c214c17ac801f5930abc57d38c3
SHA1

e9a17ed8182f92bf86babbd7ba8dd8770e8ff47e
SHA256

999ebf5ef6bf51828193deaf7697e6d22419e437c65e603bffa0bb2acc7f40c8
SHA512

30686f361db9d81c95912700af530529d4d89bf6b514a63ab5db6b20efc443b87aef44b598e45d33adee448ec1b6573ca035a1d20e11c78ea8253f1ecf5ebf38
SSDEEP

96:oIUNaXnnXyEIPtXvZhr5RwiULuxDtJy+wolpE:oIx3XyEwXvZh1RwnLUDtU+I

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3788	2832	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4936 wrote to memory of 2832	4936	rundll32.exe	83
PID 4936 wrote to memory of 2832	4936	rundll32.exe	83
PID 4936 wrote to memory of 2832	4936	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\advsplash.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\advsplash.dll,#1
  2⤵
  PID:2832
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 616
    3⤵
    - Program crash
    PID:3788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2832 -ip 2832
1⤵
PID:2120

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads