06a1996672baa5f204d5fa57d4acd5da6f97f18ef5a97ea36fe470b5a2c73b58 | Triage

Analysis

max time kernel
145s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2024, 09:08

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/LuaXml_lib.dll
Size

11KB
MD5

7292b642bd958aeb7fd7cfd19e45b068
SHA1

19a800620d041634abae5b5d096cb0e87ce4c188
SHA256

90f1bb98e034fcf7bfddb8cb0a85b27a9c9ddb01b926b4e139e1e8fc53d41d09
SHA512

bd758e0833454e0aa2af976ac94fde17c5401102c5991887cefbe8e337974381584c73e2d1e50e49263c55c3788e24dc7f8bd0b9d2a76a6cbe38e48dd9d6c44a
SSDEEP

192:YK/pDHjlL5Fv4k0CSigGpV8pVqVyoyhXnX1:N/L5FqCjpV8pVswXnX

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2920	3240	WerFault.exe	91

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 3240	5076	rundll32.exe	91
PID 5076 wrote to memory of 3240	5076	rundll32.exe	91
PID 5076 wrote to memory of 3240	5076	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LuaXml_lib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LuaXml_lib.dll,#1
  2⤵
  PID:3240
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3240 -s 604
    3⤵
    - Program crash
    PID:2920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3240 -ip 3240
1⤵
PID:4768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4040,i,10373433614523925616,13586256558317053467,262144 --variations-seed-version --mojo-platform-channel-handle=4104 /prefetch:8
1⤵
PID:1216

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3240-0-0x0000000000950000-0x0000000000978000-memory.dmp

Filesize
160KB

Download
memory/3240-1-0x0000000010000000-0x0000000010009000-memory.dmp

Filesize
36KB

Download