0534bd590fba16ba535feaa26babf7dd209ab721ade2c11ffbd26dd44712015a | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 11:04

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/UAC.dll
Size

14KB
MD5

b7d7324f2128531c9777d837516b65a6
SHA1

e15e44fc7c907329e1cd3985e8666b4332f4fa48
SHA256

530dc2b26366fc86072487438317a5723a10ff8b38522f9e813df19146a31033
SHA512

829fc241cd377de094faf80bb38828c3d877170ca4a3fd85810bc911d2ce38941f8067ef681c21d8bbc04be8a99a3d32b3aec51ae7b32d3a89e5a9d9597ed8d5
SSDEEP

192:+kipfAcFT9GlPjP5yIUbf7V8rdawGYiYIRTRGczl6MAW1p2oXO8ham:+VNAcXyDUB3VJbR5l6MAW1p88z

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2268	1908	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 1908	1904	rundll32.exe	28
PID 1904 wrote to memory of 1908	1904	rundll32.exe	28
PID 1904 wrote to memory of 1908	1904	rundll32.exe	28
PID 1904 wrote to memory of 1908	1904	rundll32.exe	28
PID 1904 wrote to memory of 1908	1904	rundll32.exe	28
PID 1904 wrote to memory of 1908	1904	rundll32.exe	28
PID 1904 wrote to memory of 1908	1904	rundll32.exe	28
PID 1908 wrote to memory of 2268	1908	rundll32.exe	29
PID 1908 wrote to memory of 2268	1908	rundll32.exe	29
PID 1908 wrote to memory of 2268	1908	rundll32.exe	29
PID 1908 wrote to memory of 2268	1908	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UAC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UAC.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1908
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 224
    3⤵
    - Program crash
    PID:2268

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads