3c3cf3d710582ccbb7a45139c1acc3a8d6bcfc017b9a4aeae6bf34a292f057cd | Triage

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 00:13

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/ElevatePrivileges.dll
Size

81KB
MD5

662f8362261ba53141b2bc88499acbcf
SHA1

e976f6928f12451e5e30d707626cfa5eb8a26afc
SHA256

0d98f84230c3adddf5e5b91cc614071abf84a00b763e6c22117543796ae13e78
SHA512

d1027454efd2b905cb3a8a356c24647d8bace9895cf6968c65e1dbfa7870f34339bddac52d3eab52742a541b3078f2c79ead60e7bf495718167c5c3868abb8b7
SSDEEP

1536:hqpzymwTMsDb3BRhTmry0SkMnKBWCYRb4z+8vI:hq1ym7sDb3SywWCIbAvI

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1036 4696 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3080 wrote to memory of 4696	3080	rundll32.exe	rundll32.exe
PID 3080 wrote to memory of 4696	3080	rundll32.exe	rundll32.exe
PID 3080 wrote to memory of 4696	3080	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ElevatePrivileges.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ElevatePrivileges.dll,#1
  2⤵
  PID:4696
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 612
    3⤵
    - Program crash
    PID:1036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4696 -ip 4696
1⤵
PID:1688

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads