d24d1726864be6bf4458f9c23ab89c03506bbb7d662cb68c27dff4c97e560e91 | Triage

Analysis

max time kernel
124s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 07:13

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/KuWoNsis_new.dll
Size

97KB
MD5

86991f180010ceafd3d79fcbcbbf793d
SHA1

36078ae4127cac5f4e850a2d081424a0f5e1c679
SHA256

e50922c5f9c5c077f1f526b35bce86d326d0ee9da64563fc3b6316097b4d95e9
SHA512

2e711fd3b0196eda085876d5d05192ee15ba20677d6e1f6ea74cd8a7e8166d8cf4ff52682d92635eb560d7eb84a56a71ad26326a09118e8709f1600d2bc89782
SSDEEP

1536:UY9Fs5msanhmlskC4eW2EdPznZqk/g6dzglSpt9jafCj:UY9F4mKlO4eW2E1Hg6dzglS9GE

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5040	1768	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3744 wrote to memory of 1768	3744	rundll32.exe	90
PID 3744 wrote to memory of 1768	3744	rundll32.exe	90
PID 3744 wrote to memory of 1768	3744	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\KuWoNsis_new.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3744
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\KuWoNsis_new.dll,#1
  2⤵
  PID:1768
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 612
    3⤵
    - Program crash
    PID:5040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1768 -ip 1768
1⤵
PID:3168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4204,i,7545522914305657361,9950105517201397946,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:8
1⤵
PID:1780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads