16771b1ced89bed951c8311cf2e67c9a1f4398f3f7335d4ed11bbcfbc8a3f00d | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 01:57

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/InvokeShellVerb.dll
Size

4KB
MD5

1a6e1ea7e90e50d9a18e034e7cde41a6
SHA1

93148d67fc2cee4537f749a8c98a0735065241a8
SHA256

2fddc8b8ab4bf4838ea374d25e4cb9e83362c3f1cb24f380137d14c814d56169
SHA512

53d35e9e4a0d45a5b37da7952f7bf8c26666fa57748c3d292fd154e40a602f08ad55735cefe9bdf043e03e3eff3e58d603bd9980ef291b3c5f409228dd5ba872

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1740 1852 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1904 wrote to memory of 1852	1904	rundll32.exe	rundll32.exe
PID 1904 wrote to memory of 1852	1904	rundll32.exe	rundll32.exe
PID 1904 wrote to memory of 1852	1904	rundll32.exe	rundll32.exe
PID 1904 wrote to memory of 1852	1904	rundll32.exe	rundll32.exe
PID 1904 wrote to memory of 1852	1904	rundll32.exe	rundll32.exe
PID 1904 wrote to memory of 1852	1904	rundll32.exe	rundll32.exe
PID 1904 wrote to memory of 1852	1904	rundll32.exe	rundll32.exe
PID 1852 wrote to memory of 1740	1852	rundll32.exe	WerFault.exe
PID 1852 wrote to memory of 1740	1852	rundll32.exe	WerFault.exe
PID 1852 wrote to memory of 1740	1852	rundll32.exe	WerFault.exe
PID 1852 wrote to memory of 1740	1852	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InvokeShellVerb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1904

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InvokeShellVerb.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 224
3⤵
- Program crash
PID:1740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads