b87cfba8a4f2329b0b372326a7f169f5896459a6bdae0ad8857b576129722204

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14-05-2024 13:49

Target

$TEMP/planula.dll
Size

72KB
MD5

6abeff0d3c52cf017e36e941f035c3e9
SHA1

ba0f193dd98a5502c29c4f5671ed066e2a3ae38c
SHA256

da93766a660b71b43492920bdb0478359fe86a17a3f51a0329cf6ac77e0852b2
SHA512

8b256cc4787c7aee904e36c3772916a5d06c5bde96e9bda3897ca1e7e7e1099d5e46e0d921bed64a1633a91508301ee8568211f02d7dac5dde9f84a57a5ac0a7
SSDEEP

768:RWGCacHgiB4722o+oOc2dIMSWwhC/ox1ozef/coG+izus+9dIt1t7RkUi4e9X:YIVS2o+c2dnSWV/oGe8n329dstlfe

Score

4^/10

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\win.ini	rundll32.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4204	1600	WerFault.exe	92
1632	1600	WerFault.exe	92

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3420 wrote to memory of 1600	3420	rundll32.exe	92
PID 3420 wrote to memory of 1600	3420	rundll32.exe	92
PID 3420 wrote to memory of 1600	3420	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\planula.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3420
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\planula.dll,#1
  2⤵
  - Drops file in Windows directory
  PID:1600
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 1016
    3⤵
    - Program crash
    PID:4204
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 792
    3⤵
    - Program crash
    PID:1632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1600 -ip 1600
1⤵
PID:3920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1600 -ip 1600
1⤵
PID:3220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3940 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:4084

C:\Windows\win.ini

Filesize
131B

MD5
9848e4efb0abd437d65e6d3d1d973adb

SHA1
f427ac7c50b19f66658ae7f92cbaf21110b49a47

SHA256
c8b84add37da849977a84fe62badb6cb908be99769edb70d60bcd04c0aec2a3f

SHA512
f90f1f65b6b824a526469b8d739f733a54a7f485d8b5f680de7a35fac90786bf6ba5a0b1d62e139663c5ee73b8d687cf32d4ccf188e18c53084ec12d8c216b17

Download Submit
memory/1600-0-0x00000000009D0000-0x00000000009D2000-memory.dmp

Filesize
8KB

Download
memory/1600-1-0x0000000002190000-0x0000000002191000-memory.dmp

Filesize
4KB

Download
memory/1600-2-0x00000000021A0000-0x00000000021B1000-memory.dmp

Filesize
68KB

Download