ee53e894a28570f3e592c313f9beaf3043c18097c966e86a579e3f25efc559bf | Triage

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 01:18

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/System.dll
Size

11KB
MD5

13fec0696a4173f42dd2fca2acb6175b
SHA1

50452ada2548044dcd059f875dbe01d29dcda510
SHA256

10a7572263d67996260ef440c5528dbc4637375bbca69f6ad09d7de13c2051fe
SHA512

1d5ea7988b4c9a6207bc4df8257ea62dfd66f0a734dfabf1c3a33b17f449e97348f6b7667cfa3d0b7371a761a4e3f3cfb86e4ac356ba65a112137a9ad451c78a
SSDEEP

192:tN2gQuUwXzioj4KALV2upWzVd7q1QDXEbBZ8KxHdGzyS/lx:SJoiO8V2upW7vQjS/

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2052	2272	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3560 wrote to memory of 2272	3560	rundll32.exe	82
PID 3560 wrote to memory of 2272	3560	rundll32.exe	82
PID 3560 wrote to memory of 2272	3560	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3560
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
  2⤵
  PID:2272
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 612
    3⤵
    - Program crash
    PID:2052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2272 -ip 2272
1⤵
PID:916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads