c7c1e87f74a0a769fed8b305ce43f926bd68e02e80f40976698366baa045b0cf | Triage

Analysis

max time kernel
142s
max time network
133s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
09-06-2024 06:58

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/StartMenu.dll
Size

11KB
MD5

85df499c425d84fa7a32ec501beddb8c
SHA1

4d51a499059808466bf746ba4c9ffa8e838d6c46
SHA256

6f10b7e1ede900b6b1e160833ac8ef8ad9de2bfe3ea6228376dcf6febcc12458
SHA512

096360483a1f33f68e75282eb903a0026e1dcb533414c670e6cb01fc1ce7b104be2526c270dc4cb8bc7560dca36b2a4b7268cec1b57c317d2ffe038cf586cc93
SSDEEP

192:ELB7OopThbgh9Yoo6sHUzKXW1kqJIBo5Boz9c:ELB77p6h91s0zKGWoac

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 2180	1336	rundll32.exe	28
PID 1336 wrote to memory of 2180	1336	rundll32.exe	28
PID 1336 wrote to memory of 2180	1336	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1336 -s 140
  2⤵
  PID:2180

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1336-0-0x000007FEFB0A0000-0x000007FEFB0AD000-memory.dmp

Filesize
52KB

Download