0bbf49dd0df354467d21b219a536d845f62a71ae891dbef7510708f97f82dfc8 | Triage

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2024, 06:03

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/Button.dll
Size

7KB
MD5

92debab0caea94c3e571e892fdde60dd
SHA1

fcd1f711b3c649b5cf5cc134e19524489084e456
SHA256

508b06710e1c3d4456d14a28ffa89c42097a9388ce44a6148ee1a3a3d5a26bcd
SHA512

2169d071c0c570b236c7224141dfb460a4cd6eb6e2e7fdf081c8d88d9173f639881d0dc2e33bc4881432637fb1a7336b7815236a70cf5ee638f8142d787a94fc
SSDEEP

96:nJHyCX5zNQwzwcSia/FPCHCl058i6bfZCYCbXLHBAE8j2XtbjM:0CX5tuia/o8iWZrAhAG/M

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2016	2772	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4356 wrote to memory of 2772	4356	rundll32.exe	82
PID 4356 wrote to memory of 2772	4356	rundll32.exe	82
PID 4356 wrote to memory of 2772	4356	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Button.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Button.dll,#1
  2⤵
  PID:2772
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2772 -s 612
    3⤵
    - Program crash
    PID:2016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2772 -ip 2772
1⤵
PID:2748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads