879a1f5ebda081f1ca1db7750a0c159136288d1185d54fe0b01ee5f62ea169f9 | Triage

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/06/2024, 00:30

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/System.dll
Size

18KB
MD5

2db076f87de4a7671eb48f9a4ec6c59a
SHA1

fe03da9ffa5ce73fdf4b742861c2dc94449b9e95
SHA256

3a3e51c653a66e42a0422a0cef861f374843d227eb79ea31788d19e1f9d0628d
SHA512

e535171ad7ef18fa275568125dd73135b610faa60a5c15987f639a6ce4af033937e820ba781cdbe1b74c2b55edc36bcce72f6894cd15e254e2b1ca765ce7e901
SSDEEP

384:q/Qlt7wiij/lMRv/9V4bvrFf4c8ZpH3GCJEAZI7i:qaeiijipUviRBEef

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
800	4644	WerFault.exe	91

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3248 wrote to memory of 4644	3248	rundll32.exe	91
PID 3248 wrote to memory of 4644	3248	rundll32.exe	91
PID 3248 wrote to memory of 4644	3248	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3248
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
  2⤵
  PID:4644
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 612
    3⤵
    - Program crash
    PID:800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 4644 -ip 4644
1⤵
PID:4664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
1⤵
PID:2888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads