d3b8570127cc320f9bf85cc44dac5d9f17a276f6a02f0dd9c0847602d61d3c31 | Triage

Analysis

max time kernel
126s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 14:11

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/SetService.dll
Size

96KB
MD5

d4e40c13bc0ba3eebb4a018bfbeb6aa2
SHA1

5c761a48304029f403a56a8df0192ad0537c17a1
SHA256

b1f194c603185b47cfea25a505775f0f2f807ee60d46aacf47b815466f02f65d
SHA512

577af07edcf1c0e56bb8332f60963357a34ae919c3e2a5af83a2916124cc933264d1c522633b555314cd47ba6b5e7cd64d5caa09949f968d0a10ad61f2255523
SSDEEP

1536:uNJzeUTMgOo2et+H6SP/XSBaDtDdArsuvYht:CSFvLS+aDEJDesr

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4664	224	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 224	2156	rundll32.exe	88
PID 2156 wrote to memory of 224	2156	rundll32.exe	88
PID 2156 wrote to memory of 224	2156	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SetService.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SetService.dll,#1
  2⤵
  PID:224
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 616
    3⤵
    - Program crash
    PID:4664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 224 -ip 224
1⤵
PID:396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4672,i,15142778360084620907,1763097090506261076,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:8
1⤵
PID:1624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads