9d6ed95597857927f0e7e6eb1495c4ec10fa74aced7efbc9199c4392be7585a6 | Triage

Analysis

max time kernel
135s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 02:57

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/EstUrl.dll
Size

181KB
MD5

ab6fc99aec69b6caa3566eaa1dbab451
SHA1

1f6aad7e7ad4469707a873a3d549f44eceacc516
SHA256

d924b3f323cbb9c81292c84b1e8e768ae9e25f1cc35f3aa775b0c5100eabb39b
SHA512

b126e18f8738c5b6379818e79ac46b359e6afad60c4ae530d5d01649ab09e93b38574c46b4cfc33813a6723b6a257aececadcc07dd62382532037e65e1539aad
SSDEEP

3072:hB+veiBP1HaqoGjjLiuTAzaejI7YvnLu3ScsHASI5dOHo:qve0oGjJ/tsHfI

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

932 8 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3076 wrote to memory of 8	3076	rundll32.exe	rundll32.exe
PID 3076 wrote to memory of 8	3076	rundll32.exe	rundll32.exe
PID 3076 wrote to memory of 8	3076	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\EstUrl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3076

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\EstUrl.dll,#1
2⤵
PID:8

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8 -s 632
3⤵
- Program crash
PID:932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 8 -ip 8
1⤵
PID:3556

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...