879a1f5ebda081f1ca1db7750a0c159136288d1185d54fe0b01ee5f62ea169f9 | Triage

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/06/2024, 00:30

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/xml.dll
Size

655KB
MD5

a0c4cc0fa4da74565189c1070852f2fc
SHA1

8226cc52db9d6c31c58a17fc5a64ff0e38741815
SHA256

1255e17c51649efa6ffd4b4fa045fbd5fcc2ef7f57e4719253e0d616306cd4b3
SHA512

3ee7183b785625dcbaeb1b54f1c58ac3a01c6ffdf18f129bc233376aaddd8d7f2e82e0bf04afe540ab0db9c11117a74815b4b4f50822e654c997514f0897138e
SSDEEP

12288:No+WEhu4KKmSdPy11hcB2niHDaG6hh+Whmiya5ccOqW3RBBppANW:3WElKichfh+Wh1yEccFcpANW

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4444	1708	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 1708	1536	rundll32.exe	83
PID 1536 wrote to memory of 1708	1536	rundll32.exe	83
PID 1536 wrote to memory of 1708	1536	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\xml.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\xml.dll,#1
  2⤵
  PID:1708
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 600
    3⤵
    - Program crash
    PID:4444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1708 -ip 1708
1⤵
PID:2280

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads