13ab2f5701d9da5f1fa11536b2543c0b0d40ce91df05b26bc86a27abda71425d | Triage

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2024, 10:04

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/jmowkfl.dll
Size

158KB
MD5

ef0e61799e4140333fbce61138cd575a
SHA1

3f3d12bff4ab5c0af54d8414542bd3500aae011d
SHA256

3effce0f8846573ee11527e2b6179d6a199c3acded5f69d335e591c56236a51e
SHA512

7404f02f7253f0cb4c08663d1012d438d9a77c0e9e84eb1b6cd924551271cd41753dbb5d66783dbfbc368634a7527e73e7cd48413399acbc320e55b47992089d
SSDEEP

3072:G8ypa/s1HN3S8/rCacg+7epsyfYxhF2A:D1sv/Caz4OA

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1188	4880	WerFault.exe	92

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 4880	1880	rundll32.exe	92
PID 1880 wrote to memory of 4880	1880	rundll32.exe	92
PID 1880 wrote to memory of 4880	1880	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\jmowkfl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\jmowkfl.dll,#1
  2⤵
  PID:4880
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4880 -s 600
    3⤵
    - Program crash
    PID:1188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4880 -ip 4880
1⤵
PID:5088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4084,i,5711962389779687290,1245653010537220991,262144 --variations-seed-version --mojo-platform-channel-handle=4008 /prefetch:8
1⤵
PID:1572

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads