66eee7501bc24acff3ee785b18c700e5c5c42bcc9457a95ce26243158527b4b0 | Triage

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 14:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/dtppksb.dll
Size

125KB
MD5

a56a33a7922c092f46e654999007d32c
SHA1

b2ce138d446748d7dc9a704b928f4e4feba3ae22
SHA256

e77faee44d59bd2ddcb19854b8832214c090db448416afd7a5fd896052aa81d0
SHA512

71bbe5ec565503711f26fd8f35b869321602e7e6d8525657885eb8c1f545adee6a8a4cd7e50e0621ed6fba99b1c7942105a9b50b2ad9479e3fe8765d71cba734
SSDEEP

3072:T8QEzOXhJ3e1WAJ4zTsPZpRLgHDp6V92ak:T8QhTAiqpR8u8a

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2584	5008	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4676 wrote to memory of 5008	4676	rundll32.exe	82
PID 4676 wrote to memory of 5008	4676	rundll32.exe	82
PID 4676 wrote to memory of 5008	4676	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\dtppksb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\dtppksb.dll,#1
  2⤵
  PID:5008
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 600
    3⤵
    - Program crash
    PID:2584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5008 -ip 5008
1⤵
PID:4228

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads