047bafcff705a8a3fe3ceafd93117911a15554c70c4a580e7bc758affbe86675 | Triage

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 02:14

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/hnppw.dll
Size

125KB
MD5

3c5734d72fe78fd6720d4d7f5dec353f
SHA1

1e2710c102070be7be8acd72cf6f57f732734f1b
SHA256

66f553456dcf9bfcf6424e5704d3cf10b388eda28bc6ff0b31b2cd9a1a2c487f
SHA512

9f6880a4ce781d9513c87e9d47693a43fecb836143c604d7a8fc7895bc6bbf20da2b0bdb4527c159c6afdcb628ebf2d98adde62130f7e0dcf80d304a51e8f422
SSDEEP

3072:q5AHaDHVM+UgAP74ucqr2spP0wsDx9Ow+:OGCVM/cut2sxUDx0w+

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2432	3084	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3376 wrote to memory of 3084	3376	rundll32.exe	82
PID 3376 wrote to memory of 3084	3376	rundll32.exe	82
PID 3376 wrote to memory of 3084	3376	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\hnppw.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3376
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\hnppw.dll,#1
  2⤵
  PID:3084
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 600
    3⤵
    - Program crash
    PID:2432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3084 -ip 3084
1⤵
PID:3580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads