01ccce954e6605ef3b666bddf751fa01b5a5c7f867e9fd8ef18c4b1cc4128b20 | Triage

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 13:36

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/StartMenu.dll
Size

6KB
MD5

1c070779dcc05617d6cb5978881702cd
SHA1

988de0ee7e294d9a10b7431d86b6a0e71fd29744
SHA256

9d097a1f11f1774745f41194dc674b97ba59276dbfdc0201640c9f12dc58c182
SHA512

c5968a23798b65d967e9ed75e7b3dc659240d27c45c19ae43822988c670b163fb4df18230826827725b1758fa26922da9a2960611a3bd24e180a71415b2b3a39
SSDEEP

96:sLJdRZk8OkmE+WHw0FMXF6CWhFxKpKsEQhEfP0:sLjPk8OT30FFA1CP0

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4412	400	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 400	1292	rundll32.exe	83
PID 1292 wrote to memory of 400	1292	rundll32.exe	83
PID 1292 wrote to memory of 400	1292	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#1
  2⤵
  PID:400
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 600
    3⤵
    - Program crash
    PID:4412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 400 -ip 400
1⤵
PID:4876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads