0a6180189e4f5911e0bdf60d52fa85a31cf1f6a55625b3bb17d066e07a1a4705 | Triage

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 00:20

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/ElevatePrivileges.dll
Size

81KB
MD5

662f8362261ba53141b2bc88499acbcf
SHA1

e976f6928f12451e5e30d707626cfa5eb8a26afc
SHA256

0d98f84230c3adddf5e5b91cc614071abf84a00b763e6c22117543796ae13e78
SHA512

d1027454efd2b905cb3a8a356c24647d8bace9895cf6968c65e1dbfa7870f34339bddac52d3eab52742a541b3078f2c79ead60e7bf495718167c5c3868abb8b7
SSDEEP

1536:hqpzymwTMsDb3BRhTmry0SkMnKBWCYRb4z+8vI:hq1ym7sDb3SywWCIbAvI

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1988 1848 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2044 wrote to memory of 1848	2044	rundll32.exe	rundll32.exe
PID 2044 wrote to memory of 1848	2044	rundll32.exe	rundll32.exe
PID 2044 wrote to memory of 1848	2044	rundll32.exe	rundll32.exe
PID 2044 wrote to memory of 1848	2044	rundll32.exe	rundll32.exe
PID 2044 wrote to memory of 1848	2044	rundll32.exe	rundll32.exe
PID 2044 wrote to memory of 1848	2044	rundll32.exe	rundll32.exe
PID 2044 wrote to memory of 1848	2044	rundll32.exe	rundll32.exe
PID 1848 wrote to memory of 1988	1848	rundll32.exe	WerFault.exe
PID 1848 wrote to memory of 1988	1848	rundll32.exe	WerFault.exe
PID 1848 wrote to memory of 1988	1848	rundll32.exe	WerFault.exe
PID 1848 wrote to memory of 1988	1848	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ElevatePrivileges.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2044

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ElevatePrivileges.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1848 -s 220
3⤵
- Program crash
PID:1988

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...