6d6611463a02ae95421da86ea2be11fbeb260fddfdedb20be9561616ff33ced5 | Triage

Analysis

max time kernel
94s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240708-en
resource tags

arch:x64arch:x86image:win10v2004-20240708-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 00:50

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/DcryptDll.dll
Size

10KB
MD5

69dc2ed40717e5a0dfa3feaa902f448e
SHA1

07a6a0b6028a92e0c822cfe9b119aa1e81b28a79
SHA256

73e8489b06789803dcab0f4bcae4281f1477ec652f80714c3b78671f73cfefad
SHA512

f41e457466fcc979864829861bf421ad2589ec6b5afc81d19424f7af285ce1fb7ce25cc4067e53cd379621b5b8098882210e4535a4d53555b7816edcc2186a3c
SSDEEP

192:ytTlNqjCZv12CDkFhrF5+ykYF8IwWzS3+1ZxIujmMAm:MTlEWZEjF5/yIwp3gIuj

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5112	3200	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3156 wrote to memory of 3200	3156	rundll32.exe	80
PID 3156 wrote to memory of 3200	3156	rundll32.exe	80
PID 3156 wrote to memory of 3200	3156	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\DcryptDll.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\DcryptDll.dll,#1
  2⤵
  PID:3200
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3200 -s 600
    3⤵
    - Program crash
    PID:5112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3200 -ip 3200
1⤵
PID:4736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3200-0-0x0000000010000000-0x0000000010009000-memory.dmp

Filesize
36KB

Download
memory/3200-1-0x0000000000E30000-0x0000000000E31000-memory.dmp

Filesize
4KB

Download
memory/3200-3-0x0000000010000000-0x0000000010009000-memory.dmp

Filesize
36KB

Download