15ae51a285da1f7517c1a31121ea27d1b3c38721a8f727977c343ea286961632 | Triage

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10-07-2024 12:26

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/tg.dll
Size

466KB
MD5

e3c6b0dffaff91a5f44ed46f308885e0
SHA1

14fefefd7790304e94651788949e562ba013b35a
SHA256

fc9ced29d83ca30635dd51f583c66c4434290de0a44057bc18007f8a0a6142da
SHA512

debba344f3e5159102f3783cc7d364ce41b78e6ca0df3186e850cf55e82ba865d20ad560022eb92b79e1df8b485c7830b104ac68e92938bb8ba01ca4ee18c3b0
SSDEEP

12288:iSF6ORlel+GTeAk7Xhn9813x5cHj9vhA/QBuuSE:HtlITeAk9n98tCjVhA/2

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2556	2920	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 2920	1144	rundll32.exe	82
PID 1144 wrote to memory of 2920	1144	rundll32.exe	82
PID 1144 wrote to memory of 2920	1144	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\tg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\tg.dll,#1
  2⤵
  PID:2920
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 692
    3⤵
    - Program crash
    PID:2556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2920 -ip 2920
1⤵
PID:3976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2920-0-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download