5dde351516155c3ec5f77c4b93018609d6beeb642a03f12d5da30f0e1ca9d410 | Triage

Analysis

max time kernel
91s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16-07-2024 06:46

Sharing

Report Analysis Logs

General

Target

ExtensionManager.dll
Size

81KB
MD5

87914af1bb2966187873d0894b43db6f
SHA1

a71df7273841b0ff3ad2c633c07f14c0ac680097
SHA256

9757bb4caddabfe7861c55bd4bedb41c90a3afce6a3aaf136492cbfc6c2d515d
SHA512

04798b9365b39911090b0295657642f645bd7c3bd077671dc16c0edb55abe42f463489eddf1faca772a49cc90c9e81caf7d741c14877fe23a910e01ffe9e5b4a
SSDEEP

1536:CmZlNFtFk/PSW4LHqaJlediaXfkoITMpGYD/i2zKp5JLqRY:CmZ5rlRJZ8dITMctgKp5JLqC

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1088	3960	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4176 wrote to memory of 3960	4176	rundll32.exe	85
PID 4176 wrote to memory of 3960	4176	rundll32.exe	85
PID 4176 wrote to memory of 3960	4176	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ExtensionManager.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4176
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ExtensionManager.dll,#1
  2⤵
  PID:3960
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3960 -s 600
    3⤵
    - Program crash
    PID:1088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3960 -ip 3960
1⤵
PID:1012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads