5ac959e5dee9884512f4a34623bbad2c08be427669015b917a750f7cbfbb0a75 | Triage

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 10:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Plugins/InputText.dll
Size

23KB
MD5

d4a3ccfa86889eca3b7cb333e33257ac
SHA1

2a0b39115b1d20457c67e082ff32d84e61ebb26b
SHA256

f35770dde8d01b7e10f969aa1202155b8b0bed9c29c4f8b40d7e683ebe73d0ab
SHA512

65ed0b36cb181b75478b50d5880e7301dd32c8933fc43d95a346a49b9fe69d8efd7bb67719e030ea79079034b7d04737fa12ebd4ba08299169a44ee03769ca1e
SSDEEP

384:ALTJ6I2BatWSdduVbdJjgaseXPG69d4NjU7J:AvJ6/atWSdYM+esjl

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3640	1056	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 1056	1036	rundll32.exe	80
PID 1036 wrote to memory of 1056	1036	rundll32.exe	80
PID 1036 wrote to memory of 1056	1036	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\InputText.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\InputText.dll,#1
  2⤵
  PID:1056
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 984
    3⤵
    - Program crash
    PID:3640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1056 -ip 1056
1⤵
PID:4720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1056-0-0x0000000002270000-0x0000000002280000-memory.dmp

Filesize
64KB

Download
memory/1056-1-0x0000000074A4E000-0x0000000074A4F000-memory.dmp

Filesize
4KB

Download
memory/1056-2-0x0000000002250000-0x000000000225E000-memory.dmp

Filesize
56KB

Download
memory/1056-3-0x0000000075380000-0x000000007538E000-memory.dmp

Filesize
56KB

Download