6abf9fcec5883b6e4d70810e60bd2d8a133a1a62bc28ca5d17dcc6f45d35214a | Triage

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 17:39

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/Dialer.dll
Size

3KB
MD5

18adbaf253b4483e59a94be06a9135e9
SHA1

e096e87c93c80077d9726a585e52af2d46fa61ec
SHA256

62f01d82e12633f1aa677a6c8c2e34316ab422d240179d8bac8ce6582f84f6f4
SHA512

2ec8ef2486f631e63ab357420535eca64f7d7c369988967fe46adf58a6f12944de385b8002436b1ddc1e88cbc6968c6981caa0bb10168a073644fd9c2ec87f83

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2076 2232 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 376 wrote to memory of 2232	376	rundll32.exe	rundll32.exe
PID 376 wrote to memory of 2232	376	rundll32.exe	rundll32.exe
PID 376 wrote to memory of 2232	376	rundll32.exe	rundll32.exe
PID 376 wrote to memory of 2232	376	rundll32.exe	rundll32.exe
PID 376 wrote to memory of 2232	376	rundll32.exe	rundll32.exe
PID 376 wrote to memory of 2232	376	rundll32.exe	rundll32.exe
PID 376 wrote to memory of 2232	376	rundll32.exe	rundll32.exe
PID 2232 wrote to memory of 2076	2232	rundll32.exe	WerFault.exe
PID 2232 wrote to memory of 2076	2232	rundll32.exe	WerFault.exe
PID 2232 wrote to memory of 2076	2232	rundll32.exe	WerFault.exe
PID 2232 wrote to memory of 2076	2232	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Dialer.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:376

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Dialer.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 228
3⤵
- Program crash
PID:2076

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...