16771b1ced89bed951c8311cf2e67c9a1f4398f3f7335d4ed11bbcfbc8a3f00d | Triage™

Analysis

max time kernel
134s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 01:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$PLUGINSDIR/InvokeShellVerb.dll
Size 4KB
Sample240522-cdkljagg25
SHA256 2fddc8b8ab4bf4838ea374d25e4cb9e83362c3f1cb24f380137d14c814d56169
MD5 1a6e1ea7e90e50d9a18e034e7cde41a6
SHA1 93148d67fc2cee4537f749a8c98a0735065241a8
SHA512 53d35e9e4a0d45a5b37da7952f7bf8c26666fa57748c3d292fd154e40a602f08ad55735cefe9bdf043e03e3eff3e58d603bd9980ef291b3c5f409228dd5ba872
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3472	2140	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 2140	4948	rundll32.exe	83
PID 4948 wrote to memory of 2140	4948	rundll32.exe	83
PID 4948 wrote to memory of 2140	4948	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InvokeShellVerb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InvokeShellVerb.dll,#1
  2⤵
  PID:2140
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 612
    3⤵
    - Program crash
    PID:3472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2140 -ip 2140
1⤵
PID:4952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads