9d6ed95597857927f0e7e6eb1495c4ec10fa74aced7efbc9199c4392be7585a6 | Triage

Analysis

max time kernel
136s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 02:57

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/InstallOptions.dll
Size

14KB
MD5

21e61a7557b0e57ff9586cf91ef13662
SHA1

536b62d9ded30b12fbee1868ec7d595ca06bd0a9
SHA256

1e88a9c5dfe8a1ef6d3f2cd6c749228fba284425a6c7a777a9524aff54d85fed
SHA512

a78db414522b12884c8d2ae3b86814980f9f157cfe75f2375434f1208678d9ce6301fa7cfd5ad8ab7420818dd3cc4fe975e6d985e27f0232341a8768e26d417f
SSDEEP

384:aOz0RcZG+IWorTemIi6COLcvoFZCfzLZkWi:wcZ7YbHROU0Mf0

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4368 1032 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2620 wrote to memory of 1032	2620	rundll32.exe	rundll32.exe
PID 2620 wrote to memory of 1032	2620	rundll32.exe	rundll32.exe
PID 2620 wrote to memory of 1032	2620	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2620

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
2⤵
PID:1032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1032 -s 644
3⤵
- Program crash
PID:4368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1032 -ip 1032
1⤵
PID:4288

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...