65f6a6e1910cca25ca3c6e6bf41f5a0a9832a6c11cbbba38bbc20291ae47899a | Triage

Analysis

max time kernel
51s
max time network
58s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16-06-2024 12:04

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/Linker.dll
Size

7KB
MD5

4d7bbb06eaba0a221d4f50f868f93d81
SHA1

370cb0655fe5839d430d7edc60de34d127987837
SHA256

fdf83b6cd8df4a202cc698222aaaa9f3e39e9af1bde3d7aeab7b93b98ce0a51a
SHA512

84c98f6dbdf0ba8f96216c05954b907b7c87f1b7502a13989c69d9def9def9c2302ee6dea2ff49b7fdd546a8d0739230d31e5e1353b83cb407c9533cb342850c
SSDEEP

96:ecGy70RHRBXvytUc4Xv9ql5XYXRZpYwCHbk3gv:eY70RHHatj4/MXYXnuVHbLv

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4632 4828 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2484 wrote to memory of 4828	2484	rundll32.exe	rundll32.exe
PID 2484 wrote to memory of 4828	2484	rundll32.exe	rundll32.exe
PID 2484 wrote to memory of 4828	2484	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Linker.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Linker.dll,#1
  2⤵
  PID:4828
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 600
    3⤵
    - Program crash
    PID:4632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4828 -ip 4828
1⤵
PID:5792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads