359fe598079b923431adb9f2f1492ff67711ac8204b9109b2b6ee20ee10a012d | Triage

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 12:48

Sharing

Report Analysis Logs

General

Target

SSShim.dll
Size

107KB
MD5

958e728ff126cc10d96c55ffcd4809ea
SHA1

4446bd7a91396a016c065a287cd36baccbb25932
SHA256

359fe598079b923431adb9f2f1492ff67711ac8204b9109b2b6ee20ee10a012d
SHA512

e26bbde3c60a01ae28877b68dafe28f60b95a9eef82dd525ab4e395ab669c0e7e40cc36ac512102c15333ac7e33792f9da657ce0da467da3f94103b30d84b115
SSDEEP

3072:LAuTswhopeZfOxm3nKWDv0QRqhXtB4Mhl2h:MAsko8BO2LDv0QRqhXtB4

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2148	1456	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 1456	4604	rundll32.exe	84
PID 4604 wrote to memory of 1456	4604	rundll32.exe	84
PID 4604 wrote to memory of 1456	4604	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SSShim.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SSShim.dll,#1
  2⤵
  PID:1456
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 600
    3⤵
    - Program crash
    PID:2148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1456 -ip 1456
1⤵
PID:1692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads