f620c53ba1917ecf52cf98c5d9af334311ae00de9915200e641efcb90eccb6ea | Triage

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-05-2024 19:55

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/System.dll
Size

11KB
MD5

41a3c964232edd2d7d5edea53e8245cd
SHA1

76d7e1fbf15cc3da4dd63a063d6ab2f0868a2206
SHA256

8b65fec615c7b371c23f8f7f344b12dc5085e40a556f96db318ed757494d62d5
SHA512

fa16bd9d020602e3065afd5c0638bc37775b40eb18bfa33b4ca5babcc3e6f112ae7d43457a6e9685ddbe6e94b954a1dc43d1da7af9ca7464019a3f110af549c1
SSDEEP

192:s/er7uivwq1XpKs4FVWSjMd8tIg2cREbyCsZ8q2R4SyIXe:sQ7Xws4FVWig86/5eCBqSyIXe

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2084 2036 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2812 wrote to memory of 2036	2812	rundll32.exe	rundll32.exe
PID 2812 wrote to memory of 2036	2812	rundll32.exe	rundll32.exe
PID 2812 wrote to memory of 2036	2812	rundll32.exe	rundll32.exe
PID 2812 wrote to memory of 2036	2812	rundll32.exe	rundll32.exe
PID 2812 wrote to memory of 2036	2812	rundll32.exe	rundll32.exe
PID 2812 wrote to memory of 2036	2812	rundll32.exe	rundll32.exe
PID 2812 wrote to memory of 2036	2812	rundll32.exe	rundll32.exe
PID 2036 wrote to memory of 2084	2036	rundll32.exe	WerFault.exe
PID 2036 wrote to memory of 2084	2036	rundll32.exe	WerFault.exe
PID 2036 wrote to memory of 2084	2036	rundll32.exe	WerFault.exe
PID 2036 wrote to memory of 2084	2036	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2812

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 228
3⤵
- Program crash
PID:2084

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads