350f2b7af2310de1eec502397eb73b1e5c909b989294a1e988911c07a8ec616c | Triage

Analysis

max time kernel
96s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2024, 21:40

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/lua51.dll
Size

160KB
MD5

13c3a33c1f6e43f38de533fd0b766c98
SHA1

6b92c3d6694ddc40d9b75853baa51cb2f9f8db13
SHA256

4158063b0a868431f6430f54c1192bf20e58a43a6d3d03b740e090951e2f4427
SHA512

d64466c03deec744e7c0bfc23e54ee91a4eff4075fb92ef97c0014bbfb00e0d21731119a3a199fb9cac4a528419e8b8066589eddadb16b445ea298d67b037c15
SSDEEP

3072:Xav/NW/emSwpvxnXuVUMywUYVtR10JOwmWQ:XaHw/e4b+Vnywn7zwmH

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4968	4020	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 4020	2904	rundll32.exe	82
PID 2904 wrote to memory of 4020	2904	rundll32.exe	82
PID 2904 wrote to memory of 4020	2904	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\lua51.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\lua51.dll,#1
  2⤵
  PID:4020
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 600
    3⤵
    - Program crash
    PID:4968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4020 -ip 4020
1⤵
PID:3020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads