ee53e894a28570f3e592c313f9beaf3043c18097c966e86a579e3f25efc559bf | Triage

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 01:18

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/isx.dll
Size

403KB
MD5

c871a7588af48899702611e0542197e8
SHA1

9c48f4313ead4955ac2a54db94178f66200af557
SHA256

c271707501470fdd06d89b01963d8ddc653a6f14e31bea6276f9d087358de9c1
SHA512

7b38f54e599202deeb161b65754bce132b85cc3412178a8e9a5681d2506534e0e379182815cf8b5f8fd3c47d7fa0976d12015efa72d4cd5d8653491c66565bc7
SSDEEP

6144:IrBoOiK91piB0qXGRWee4jdCLSvMOAkHQ87tWH9WbyjAVyMKHQ:IrBpoiEH+vMOAkw87tAU6nMKw

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
912	224	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3764 wrote to memory of 224	3764	rundll32.exe	82
PID 3764 wrote to memory of 224	3764	rundll32.exe	82
PID 3764 wrote to memory of 224	3764	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\isx.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3764
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\isx.dll,#1
  2⤵
  PID:224
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 680
    3⤵
    - Program crash
    PID:912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 224 -ip 224
1⤵
PID:3160

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads