ba090f00dec7afbd561670d2a345193fe2d8c10688aa3b5c73972918d1a55a4a | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26-06-2024 05:25

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/UAC.dll
Size

13KB
MD5

7f56c0d6a8733dec142814ed5a58b0ee
SHA1

c119e66f179cfb758966f3cf878466057bea1840
SHA256

86445396775370aff5834f10bda25e505b6f89efc69a04fe1ce46f5d128be73f
SHA512

8b3b9bed985b3583b7be8b2197bb068e5d5508f8b5c4a7fc1278b2662dc8d9a53fd6df63f636e44bfc5aa37f030ac76b8d259d6b446bf87d5c72b74ff5b158f3
SSDEEP

384:d/lNMKbnRWKYyCvDvQH3yBf/qPNGkVWYyLrcMf9VQ8c:d/lq+RDYJf/qPNGkQ5LrcCQ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2612 2140 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1384 wrote to memory of 2140	1384	rundll32.exe	rundll32.exe
PID 1384 wrote to memory of 2140	1384	rundll32.exe	rundll32.exe
PID 1384 wrote to memory of 2140	1384	rundll32.exe	rundll32.exe
PID 1384 wrote to memory of 2140	1384	rundll32.exe	rundll32.exe
PID 1384 wrote to memory of 2140	1384	rundll32.exe	rundll32.exe
PID 1384 wrote to memory of 2140	1384	rundll32.exe	rundll32.exe
PID 1384 wrote to memory of 2140	1384	rundll32.exe	rundll32.exe
PID 2140 wrote to memory of 2612	2140	rundll32.exe	WerFault.exe
PID 2140 wrote to memory of 2612	2140	rundll32.exe	WerFault.exe
PID 2140 wrote to memory of 2612	2140	rundll32.exe	WerFault.exe
PID 2140 wrote to memory of 2612	2140	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UAC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1384

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UAC.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 224
3⤵
- Program crash
PID:2612

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...