c1325391f2a2ba9a56a97e44ed8f308abbb00d96007a79f52796d34cfa60d0cc | Triage

Analysis

max time kernel
148s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 06:41

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/inetc.dll
Size

58KB
MD5

34aafdcc9ba1a2acc6d6fe9ca347ac7b
SHA1

23a4f3ea483d8643d427b29ed92af8253c0d3e6b
SHA256

baf9f333f6276ed10cd1c29c619d1e9143e9b751c5a043d8212567333d0aa9cd
SHA512

1ded039235005fc6ea3bdbaac2e4d74892188e089d95ddca1486a1c83dba1b67eca72b3e1318adf3d8753a0f3fe805c6df46f9e6f1fef44bc1f469a93f6466f5
SSDEEP

768:oFTOjdPSKXRc/7SfH3qMnJQfhLNjhtajfYwnTED8ekOvnv8cUyWuZ:oAdqA+yHFJ6hrtWlIRv8cUy

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1596	3552	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4212 wrote to memory of 3552	4212	rundll32.exe	86
PID 4212 wrote to memory of 3552	4212	rundll32.exe	86
PID 4212 wrote to memory of 3552	4212	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\inetc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4212
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\inetc.dll,#1
  2⤵
  PID:3552
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 624
    3⤵
    - Program crash
    PID:1596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3552 -ip 3552
1⤵
PID:2028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads