755d11ba3943ba14071f4bdb5b10d3a1db96fdbf637a2851317304aa2523a4b4 | Triage

Analysis

max time kernel
139s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 09:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Plugins/FX/reaverb.dll
Size

79KB
MD5

f363f093b6ec59e07023e9893aa4a726
SHA1

d2c5fe9172226e1d9d4f7e39ae1502cd8597da23
SHA256

f637f7beaa5631e6707b917575d0ee8ddb0e583d22d283b98c6b03949d32b44f
SHA512

777fff2f059f99300e2d2415286f8957b519d259728a1a360c7aea9f7187a7bb157b95607c555f8a52cd5c602652492a986cf2db80b7de7399dc7e7e0a8eecc7
SSDEEP

1536:xtUUzNR/ixJ7crVB9g72cREfhvqwqn4Bdya26RDMyUw:xdzNR/8GXcREfhDqn0EaRDMyUw

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4132	1532	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 1532	912	rundll32.exe	86
PID 912 wrote to memory of 1532	912	rundll32.exe	86
PID 912 wrote to memory of 1532	912	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\FX\reaverb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:912
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\FX\reaverb.dll,#1
  2⤵
  PID:1532
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 624
    3⤵
    - Program crash
    PID:4132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1532 -ip 1532
1⤵
PID:532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads