c8e26282d16d383a962f67616a11a1338377b4f1668c57e2e652b447916ab66b | Triage

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 23:59

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/StartMenu.dll
Size

7KB
MD5

728d03c6922988977693be59715fd52e
SHA1

5f06287f574682a844722bcded04d335fb1b9a42
SHA256

3c28c4e66a5f16e7ae2c57ca9b0c2887730d82472ac1786b641bd7744931f73b
SHA512

ebad773bb271a7648d011c8d32eea35dbc8a9f1c7c0ecca440e62fd7fb0e24fc2403b548e32f7a92bb1577abb1f25ad0d353a019f253251a56a535264797f119
SSDEEP

96:Z+PBC0x22epxPEvC4FkWE+in1/FMvsCGRfRFqCB5tzGhEl5VN:Z+pepxPE1r8/FtmCDtag5v

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3264	2212	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 2212	2052	rundll32.exe	82
PID 2052 wrote to memory of 2212	2052	rundll32.exe	82
PID 2052 wrote to memory of 2212	2052	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#1
  2⤵
  PID:2212
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 612
    3⤵
    - Program crash
    PID:3264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2212 -ip 2212
1⤵
PID:1828

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads