12d13fa5af83a903bb2bb107c3d7e366c13f466eec45cd28736ed466be20da91 | Triage

Analysis

max time kernel
130s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2024 12:46

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/dnjzh.dll
Size

125KB
MD5

7d7518d98e68eebbb02ee06a931fd0c6
SHA1

73a1c22beb0381aa241a4542df29d20a9da5e033
SHA256

6fd1735c87fd55624f93a5141710324ba6c23788c8804ce387592a6599fe7f14
SHA512

bb33af0a4b0f21fb13112cdd6880575c5ff7b19b67ec6db74f7c558a7666f8aa34864650313a4e5f56afb239da0d7e1a6c9e6c1d789907aa2c31e930e7103117
SSDEEP

3072:A5AHaDHVM+UgAP74ucqr2spP0waDx9Ow+:gGCVM/cut2sxCDx0w+

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3468	1008	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 1008	4912	rundll32.exe	83
PID 4912 wrote to memory of 1008	4912	rundll32.exe	83
PID 4912 wrote to memory of 1008	4912	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\dnjzh.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\dnjzh.dll,#1
  2⤵
  PID:1008
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1008 -s 600
    3⤵
    - Program crash
    PID:3468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1008 -ip 1008
1⤵
PID:3268

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads