8ef8966a875cbad9a45f07de83771c2bdddb8f776241db410240d6c3ca20314d | Triage

Analysis

max time kernel
135s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
16-05-2024 05:26

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/System.dll
Size

16KB
MD5

b229694657d51375d45d2fe5bd2a0616
SHA1

4fd6e5ce354f7d72613213c57c20d362c11d4d2f
SHA256

36eb621d65ed1236d4e1b8cb01dd39cc69ab5052f227fb21694830e60703a739
SHA512

fcf47391964d90ac52ceda9a6cdfddea60ab09c251ebd89f48443a1880817f89b9d0db2d1830b7ad17787e4df9a534aea8e7fd826cef2f677b7c2e693bbdf4da
SSDEEP

384:9CAGCYNs4C/nWxVg8kTM1yTFYgLMCVORJO3eMIAE:9C9CYNnC/P8kg18TgTJOpE

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4332	4180	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 4180	1160	rundll32.exe	82
PID 1160 wrote to memory of 4180	1160	rundll32.exe	82
PID 1160 wrote to memory of 4180	1160	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
  2⤵
  PID:4180
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4180 -s 612
    3⤵
    - Program crash
    PID:4332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4180 -ip 4180
1⤵
PID:3288

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads