149c26e5258f761658c3157b67db9ffb48b76df1c66febf6ec51cfb3e186f792 | Triage

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2024, 05:00

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/rjyyqfg.dll
Size

158KB
MD5

799c50bd1c2966ef98bf12062646c37f
SHA1

1acb3e6e7eb5d699c3265af3f42eb1f46efcad5c
SHA256

c396a227874eead9eefd81352917315f9c50de6db0a86e2e3ebd6a66efaef2a2
SHA512

b397b3a3e40a18db680ccd8b23e252cbcdd4d68bae9567d44192c98579c14553a272ae5240f231f448b93fea5f134096dbebba98a00e7685f3184d6c2ef0096d
SSDEEP

3072:TMvt6YatbMGdF/zwKAu30Q6+JWzY6jgUHb7d:TMUDdCO0VD9zb7

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1076	1280	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4356 wrote to memory of 1280	4356	rundll32.exe	83
PID 4356 wrote to memory of 1280	4356	rundll32.exe	83
PID 4356 wrote to memory of 1280	4356	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\rjyyqfg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\rjyyqfg.dll,#1
  2⤵
  PID:1280
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1280 -s 600
    3⤵
    - Program crash
    PID:1076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1280 -ip 1280
1⤵
PID:3956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads