05abcaacc5ee162814748435645b745b6f3467f38f753fe51668167a215125ef | Triage

Analysis

max time kernel
92s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29-05-2024 21:06

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/CABSetup.dll
Size

30KB
MD5

0645c3c0a775041eb51277c4e93121ef
SHA1

3963d0016da8c2ec51777357fe5e615a1308c3b5
SHA256

91687b6cd88653f0be20b129c16dd14dd5f909a4d096218d3306ec62d3c260a2
SHA512

5a192ce1eaad049027c362e7a0c85a705ef8045c268e7fb09eab364c6da27929ab78fccf755145ea620deeb32a0954c62aa7d699249057fcd5522d45c0937a47
SSDEEP

768:BEjXk0000E0ZKz8BKvr/TTR+Hwh87O2bTGgbpffoHha:BKyuvrrdwwy7O2bTGwfoB

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2212	1832	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 1832	3056	rundll32.exe	81
PID 3056 wrote to memory of 1832	3056	rundll32.exe	81
PID 3056 wrote to memory of 1832	3056	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\CABSetup.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\CABSetup.dll,#1
  2⤵
  PID:1832
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 600
    3⤵
    - Program crash
    PID:2212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1832 -ip 1832
1⤵
PID:5004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads