5e8296e3db9f6b6823b20453aa5b9c4642152c4321c11fefb89d543b331b669d | Triage

Analysis

max time kernel
133s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02-06-2024 23:01

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/ll.dll
Size

113KB
MD5

e59a731e0e538728b68d76f2b69d8eee
SHA1

1c08ab1fa933a099bac7615d83e2253fb6533e49
SHA256

a0120f6aaeea92ff215375acf0690f3d38318178fa911275e3c88a8a1a0fe388
SHA512

8d3c022d7437c10598fb1f2c8bae5a21ff4e4f3cb842250b51d88569d3a3bb89097c9c9d55d8019630631ca77b82032c089beb9973ecc8a4cdb3f9b6f4d4e360
SSDEEP

3072:ZKUm+gv29W2pAiOUg7EVpOtGrTvqkKOM:Zvm++29W2CP7EVpOUrTSkXM

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4520	1636	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 1636	2900	rundll32.exe	83
PID 2900 wrote to memory of 1636	2900	rundll32.exe	83
PID 2900 wrote to memory of 1636	2900	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ll.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ll.dll,#1
  2⤵
  PID:1636
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1636 -s 600
    3⤵
    - Program crash
    PID:4520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1636 -ip 1636
1⤵
PID:4340

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads