060a13671e38ad7d1326fe38ad16fa81ab23a786ccebe22b3983f1a1570750eb | Triage

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2024, 04:00

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/System.dll
Size

25KB
MD5

4da858aae2a92065ecbd4d1b8cdb7c1b
SHA1

90765be6027f29128e3d2dcaeeab5615ab17663e
SHA256

dd11e64dd7ae8e9a3c890912c6bf0afc7ba4a353510a2b85f7b66c4bf66f1d96
SHA512

1798cbbeeef5337f418813240485e27a996021858d0ac548e7cb48303e07785448510e82d689f16ee37c7977288b1dab28edae772bcfd8695698af3ff4489753
SSDEEP

384:hCom2HgN4GbeWmbI4Eybogia7yOe/eMMMK6jYV1B6Dgf2hL:hCR2ACu54HogLebKg21B6Uf2hL

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
968	1768	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 1768	2740	rundll32.exe	89
PID 2740 wrote to memory of 1768	2740	rundll32.exe	89
PID 2740 wrote to memory of 1768	2740	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
  2⤵
  PID:1768
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 612
    3⤵
    - Program crash
    PID:968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1768 -ip 1768
1⤵
PID:2832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3452,i,16710585221322798697,8586257254049248207,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:8
1⤵
PID:3556

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads