5ac90ded16ebe4ad429814e349fcc77f3918d71a2432ec5c88089bde9dad1aee | Triage

Analysis

max time kernel
93s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13-06-2024 05:00

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/Aero.dll
Size

7KB
MD5

2329db4688b46b8cde1297575a8fc94c
SHA1

dcaf28dd61992df3ffc64468e1ff487193d83ad8
SHA256

2c58ec428c767ce05e3b2c18ef1e1d9be0d6cd3a97c9f33c95666ea9a66caa9b
SHA512

1e6571c14faab22e6169c21867862bbaacd17bd0d8b589d8403150c62cf022b137428b681d5cffc51b6c772cc04d1213a142f1781dd3a38892daea93e2241994
SSDEEP

192:M6nmPtvco460e35M76v9gTnDg9ZLbG7ChBsZ:UvcoIYKnDg9xhs

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral6/memory/4480-0-0x0000000074C70000-0x0000000074C7A000-memory.dmp	upx
behavioral6/memory/4480-1-0x0000000074C70000-0x0000000074C7A000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
624	4480	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 4480	1736	rundll32.exe	81
PID 1736 wrote to memory of 4480	1736	rundll32.exe	81
PID 1736 wrote to memory of 4480	1736	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Aero.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Aero.dll,#1
  2⤵
  PID:4480
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 620
    3⤵
    - Program crash
    PID:624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4480 -ip 4480
1⤵
PID:2288

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4480-0-0x0000000074C70000-0x0000000074C7A000-memory.dmp

Filesize
40KB

Download
memory/4480-1-0x0000000074C70000-0x0000000074C7A000-memory.dmp

Filesize
40KB

Download