0b77634760f23d18a28c67a4fe31f1ebdcf00de2ed2f46e8474866ef2102628d | Triage

Analysis

max time kernel
148s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 08:16

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/Dialer.dll
Size

4KB
MD5

b5be0e441e04e5bf077a90097b169d22
SHA1

22fdf908102ae4f45e45b354e2f28a9ac17eb684
SHA256

7f267c0c300ee645624dbff22329d8a1e86c2e147ee803a34c43bdee76da0255
SHA512

3cfc02b01e67cea80354de4725ec66fc1314ef68ec577a2d6f9f9bb6f8c450c777fd3ce32c21a59b935b401151221d1506d7c795dcd4e59edcf9d6a15b14c2d6

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2972	748	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 748	2024	rundll32.exe	83
PID 2024 wrote to memory of 748	2024	rundll32.exe	83
PID 2024 wrote to memory of 748	2024	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Dialer.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Dialer.dll,#1
  2⤵
  PID:748
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 748 -s 608
    3⤵
    - Program crash
    PID:2972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 748 -ip 748
1⤵
PID:716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads