2341217ac17fc4f15b57584108c09b9f4cf2d2758f2973a146b2867633e44160 | Triage

Analysis

max time kernel
92s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 13:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/ddy.dll
Size

122KB
MD5

4fba192cc0791452971d6b2a1db2e8bd
SHA1

451293b9a00c03c3063237019c3635634c74094a
SHA256

1d08e69d4367f5dc12008b470325cc644383288145323f2da0f469fc4813544a
SHA512

79dba570b3b5ff0a3d3e4bb832ada1a2c1372987b2e1d718227b2d5d83d86eb5badb42d8ed6687a41619ef592f1de275f50a7c9a2ba636392a3fdd2ad0baec4a
SSDEEP

1536:F5QUgqISQ/Qq9dOhgnzf5MhZimf1Dbj19M9VNnTBK4ZkLKsHuz:AlSNC74nR9M9BHZmDHu

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
804	3976	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 3976	4500	rundll32.exe	83
PID 4500 wrote to memory of 3976	4500	rundll32.exe	83
PID 4500 wrote to memory of 3976	4500	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ddy.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ddy.dll,#1
  2⤵
  PID:3976
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3976 -s 600
    3⤵
    - Program crash
    PID:804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3976 -ip 3976
1⤵
PID:2320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads