162a6790dc83ba17c41e5875cbee8943de8b4bc070f204a666d34963485cac88 | Triage

Analysis

max time kernel
131s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 23:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/jjlvvnt.dll
Size

161KB
MD5

91512fa4159f8ab72407d9a85d3495c1
SHA1

d2f195938e3830f22436562c1c87de0595854892
SHA256

ad6b9b9174051ea4225442259250cd0c5214b2fe00526ad9d59c72c9cc4cc9b2
SHA512

01dcc54fb3e2af3ac3a8b12851212f78c8fdb818c09e94885a48b3abe5e405c249fd4d96590a72b8b2df438fdfa0ea36eaf01121e42147fe983c64acfff511f2
SSDEEP

3072:GyHZSxgOm6M8CvGZBdz+tVdQbws0ZJkO:7cjivGZHdzWJk

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1928	2604	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3740 wrote to memory of 2604	3740	rundll32.exe	83
PID 3740 wrote to memory of 2604	3740	rundll32.exe	83
PID 3740 wrote to memory of 2604	3740	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\jjlvvnt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3740
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\jjlvvnt.dll,#1
  2⤵
  PID:2604
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 600
    3⤵
    - Program crash
    PID:1928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2604 -ip 2604
1⤵
PID:3676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads