a24c03e63449db0f994c715115c7648e88182888305be3554ef8f9a9215a0501 | Triage

Analysis

max time kernel
142s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 04:45

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/System.dll
Size

25KB
MD5

853d33d653fb8622e5fd1aa862d07aa0
SHA1

310561cc0f30657974ab627a2341adfcec84ab92
SHA256

dbeb911118606a36e430e8d8be39e944b80167fb81ccd11c56afafb25747e633
SHA512

6d944929b0a4350aba32b28ef9f26d6c8f1a7c44aade158587829101a110ac7d892a9c5ca4ce60945c8cbd63eb0df63c3e8785c871e85ad22635f0ac80dba70a
SSDEEP

384:YQi8KP2WPZVVAfsjFMOpIVKGdDWG0OkuK3TZupbm:Y+KP2zEjFMTxWG3kbu

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 1240	2012	rundll32.exe	28
PID 2012 wrote to memory of 1240	2012	rundll32.exe	28
PID 2012 wrote to memory of 1240	2012	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2012 -s 112
  2⤵
  PID:1240

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2012-0-0x000007FEFB4F0000-0x000007FEFB4FF000-memory.dmp

Filesize
60KB

Download