879a1f5ebda081f1ca1db7750a0c159136288d1185d54fe0b01ee5f62ea169f9 | Triage

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/06/2024, 00:30

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/xml.dll
Size

655KB
MD5

a0c4cc0fa4da74565189c1070852f2fc
SHA1

8226cc52db9d6c31c58a17fc5a64ff0e38741815
SHA256

1255e17c51649efa6ffd4b4fa045fbd5fcc2ef7f57e4719253e0d616306cd4b3
SHA512

3ee7183b785625dcbaeb1b54f1c58ac3a01c6ffdf18f129bc233376aaddd8d7f2e82e0bf04afe540ab0db9c11117a74815b4b4f50822e654c997514f0897138e
SSDEEP

12288:No+WEhu4KKmSdPy11hcB2niHDaG6hh+Whmiya5ccOqW3RBBppANW:3WElKichfh+Wh1yEccFcpANW

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1624	1244	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 1244	1280	rundll32.exe	28
PID 1280 wrote to memory of 1244	1280	rundll32.exe	28
PID 1280 wrote to memory of 1244	1280	rundll32.exe	28
PID 1280 wrote to memory of 1244	1280	rundll32.exe	28
PID 1280 wrote to memory of 1244	1280	rundll32.exe	28
PID 1280 wrote to memory of 1244	1280	rundll32.exe	28
PID 1280 wrote to memory of 1244	1280	rundll32.exe	28
PID 1244 wrote to memory of 1624	1244	rundll32.exe	29
PID 1244 wrote to memory of 1624	1244	rundll32.exe	29
PID 1244 wrote to memory of 1624	1244	rundll32.exe	29
PID 1244 wrote to memory of 1624	1244	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\xml.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\xml.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1244
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1244 -s 220
    3⤵
    - Program crash
    PID:1624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads