e11e1d02027ed589370e37310fb3c4e607cc29e305a201dc2cbc04ee94579153 | Triage

Analysis

max time kernel
133s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 04:46

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/LuaXml_lib.dll
Size

11KB
MD5

7292b642bd958aeb7fd7cfd19e45b068
SHA1

19a800620d041634abae5b5d096cb0e87ce4c188
SHA256

90f1bb98e034fcf7bfddb8cb0a85b27a9c9ddb01b926b4e139e1e8fc53d41d09
SHA512

bd758e0833454e0aa2af976ac94fde17c5401102c5991887cefbe8e337974381584c73e2d1e50e49263c55c3788e24dc7f8bd0b9d2a76a6cbe38e48dd9d6c44a
SSDEEP

192:YK/pDHjlL5Fv4k0CSigGpV8pVqVyoyhXnX1:N/L5FqCjpV8pVswXnX

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1576	3912	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 3912	1876	rundll32.exe	83
PID 1876 wrote to memory of 3912	1876	rundll32.exe	83
PID 1876 wrote to memory of 3912	1876	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LuaXml_lib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LuaXml_lib.dll,#1
  2⤵
  PID:3912
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3912 -s 604
    3⤵
    - Program crash
    PID:1576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3912 -ip 3912
1⤵
PID:4148

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3912-0-0x00000000010F0000-0x000000000110D000-memory.dmp

Filesize
116KB

Download
memory/3912-1-0x0000000010000000-0x0000000010009000-memory.dmp

Filesize
36KB

Download