4035c29e2effbbb4dfbb5827791653f70d17d8064a536081a87875a784eee013 | Triage

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 22:30

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/UserInfo.dll
Size

4KB
MD5

1b446b36f5b4022d50ffdc0cf567b24a
SHA1

d9a0a99fe5ea3932cbd2774af285ddf35fcdd4f9
SHA256

2862c7bc7f11715cebdea003564a0d70bf42b73451e2b672110e1392ec392922
SHA512

04ab80568f6da5eef2bae47056391a5de4ba6aff15cf4a2d0a9cc807816bf565161731921c65fe5ff748d2b86d1661f6aa4311c65992350bd63a9f092019f1b8

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2928 2836 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2816 wrote to memory of 2836	2816	rundll32.exe	rundll32.exe
PID 2816 wrote to memory of 2836	2816	rundll32.exe	rundll32.exe
PID 2816 wrote to memory of 2836	2816	rundll32.exe	rundll32.exe
PID 2816 wrote to memory of 2836	2816	rundll32.exe	rundll32.exe
PID 2816 wrote to memory of 2836	2816	rundll32.exe	rundll32.exe
PID 2816 wrote to memory of 2836	2816	rundll32.exe	rundll32.exe
PID 2816 wrote to memory of 2836	2816	rundll32.exe	rundll32.exe
PID 2836 wrote to memory of 2928	2836	rundll32.exe	WerFault.exe
PID 2836 wrote to memory of 2928	2836	rundll32.exe	WerFault.exe
PID 2836 wrote to memory of 2928	2836	rundll32.exe	WerFault.exe
PID 2836 wrote to memory of 2928	2836	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UserInfo.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2816

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UserInfo.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2836 -s 224
3⤵
- Program crash
PID:2928

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...