24124b15fa8f079623e2dc34b14da6ca3d5912af69022c5c00cbb2602c3b838a | Triage

Analysis

max time kernel
129s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 19:07

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/khvbx.dll
Size

152KB
MD5

7662739a6ee08008f23c9768e5450422
SHA1

187698d22490b46c4cb26fa00f8d4fad9c47bc24
SHA256

5c7b456d830097dcdcf3486ba31ed6fc475447a9df903fe37350a195428da5b4
SHA512

195943f40485535689ae8aaea2a5999e3a8d0fe00736b62a922ecfd645579ff66fce8efb678c337e5dcd6e1dd788c693507fafd73514daf13bec5f92835e06d4
SSDEEP

3072:G99t6F0XY0MpiO5YvJq7rVC2+FG/3s0I2/N:4DM0Kp73MG7/N

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2428 2360 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3556 wrote to memory of 2360	3556	rundll32.exe	rundll32.exe
PID 3556 wrote to memory of 2360	3556	rundll32.exe	rundll32.exe
PID 3556 wrote to memory of 2360	3556	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\khvbx.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\khvbx.dll,#1
  2⤵
  PID:2360
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2360 -s 600
    3⤵
    - Program crash
    PID:2428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2360 -ip 2360
1⤵
PID:2736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads