755d11ba3943ba14071f4bdb5b10d3a1db96fdbf637a2851317304aa2523a4b4 | Triage

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 09:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Plugins/FX/reasyndr.dll
Size

10KB
MD5

04799ecfef3a685d1230e36c55994c4a
SHA1

c6ca5699f3005fd99e8cdf5e6c62a6e3f66cdc91
SHA256

f064d2185ff28c8731fd225d3add83bec05478d1efa1f3590d877817038e6e78
SHA512

af56df2d52634b659b6a976ab5ee0461770b0c2e64dfd21f3889622c3f792936cab77e2374bf053c09929d2cc454a264cb0a53b11bc1126a6a3f105404d89daf
SSDEEP

192:lZKO1+51S0d6zrICBGMVYzADKfpIqy88UIwWwQJVUa:lh1mdc9+fpXoUijD

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2912	4952	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 4952	1216	rundll32.exe	80
PID 1216 wrote to memory of 4952	1216	rundll32.exe	80
PID 1216 wrote to memory of 4952	1216	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\FX\reasyndr.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\FX\reasyndr.dll,#1
  2⤵
  PID:4952
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 600
    3⤵
    - Program crash
    PID:2912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 4952 -ip 4952
1⤵
PID:3940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads