221b160532a8bd6357a78ab2dadbfb74a9101c030362ea6b5e1a06a7a38f4efc | Triage

Analysis

max time kernel
140s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 21:00

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/webapphost.dll
Size

827KB
MD5

4dc5c6692260f2191e1573dd1cb1bb32
SHA1

de77124c49f17798d2b576add2e1857515c35e10
SHA256

59f4916771a03fd9836df92196b31256c428fb50a287474359a55dcf03d32632
SHA512

9ab8135c7081487c8f9cca70bdb275553e722ac69aa1906af83657eb0ea8459feb0030e3417edff6abd1cce7ee06fc967babbd306e79911f767935db00fa549d
SSDEEP

24576:3AmjnnyOl5EdSjPWWTGprfljVrLjWf7IeMVXlPjF9J:3BpPWWTGhljVrLif7IeMVVZ9J

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2192	2400	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 2400	1788	rundll32.exe	83
PID 1788 wrote to memory of 2400	1788	rundll32.exe	83
PID 1788 wrote to memory of 2400	1788	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\webapphost.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\webapphost.dll,#1
  2⤵
  PID:2400
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 640
    3⤵
    - Program crash
    PID:2192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2400 -ip 2400
1⤵
PID:4404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads