206653547f89a412dd77a9e7e17a4e2b4e699a1a0849d68e2469433ff9332de6 | Triage

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2024, 02:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/ll.dll
Size

113KB
MD5

e59a731e0e538728b68d76f2b69d8eee
SHA1

1c08ab1fa933a099bac7615d83e2253fb6533e49
SHA256

a0120f6aaeea92ff215375acf0690f3d38318178fa911275e3c88a8a1a0fe388
SHA512

8d3c022d7437c10598fb1f2c8bae5a21ff4e4f3cb842250b51d88569d3a3bb89097c9c9d55d8019630631ca77b82032c089beb9973ecc8a4cdb3f9b6f4d4e360
SSDEEP

3072:ZKUm+gv29W2pAiOUg7EVpOtGrTvqkKOM:Zvm++29W2CP7EVpOUrTSkXM

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2564	3252	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4192 wrote to memory of 3252	4192	rundll32.exe	81
PID 4192 wrote to memory of 3252	4192	rundll32.exe	81
PID 4192 wrote to memory of 3252	4192	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ll.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4192
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ll.dll,#1
  2⤵
  PID:3252
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3252 -s 600
    3⤵
    - Program crash
    PID:2564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3252 -ip 3252
1⤵
PID:1604

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads