9b73f8eb1505799749b1b15c7a9ed63448f6b7658a2ef912dc4ce2b57b38ad7d | Triage

Analysis

max time kernel
41s
max time network
49s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
05-07-2024 01:38

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/INetC.dll
Size

235KB
MD5

8ee31a2916657afde78bf5e33fd4bb15
SHA1

ef98d0c6dd7ce6b348a91c683ce9175e56c3a522
SHA256

1d8e76baf1de113c119061bea74ef2e8e684c65c2c9675f93970909f0879cdc8
SHA512

318f5715956e3aacacfeccce920a8cd48998a5cfa65dd933afbfdef57b1675735312060950a7245e5c3e8784a61bcb3e8f9bb10e85774466504f7a7e3526af2b
SSDEEP

3072:8tNXMxiQraqoDDfbrH6ZgxkzStPpwGxqeujXj5Bif/Pa0A:8DXMLaqoDfb6mxk2LqHXj3if/Pa

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1636	2088	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 2088	2816	rundll32.exe	80
PID 2816 wrote to memory of 2088	2816	rundll32.exe	80
PID 2816 wrote to memory of 2088	2816	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\INetC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\INetC.dll,#1
  2⤵
  PID:2088
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2088 -s 624
    3⤵
    - Program crash
    PID:1636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 2088 -ip 2088
1⤵
PID:4956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads