a0fb470a9d6e58f2e0d19aa47b2b37e814fd442fcdf22b769d5908df38a54a86 | Triage

Analysis

max time kernel
133s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 08:36

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/ILUninstall.dll
Size

405KB
MD5

a11d063ca9a520b882ebbe31e666fd5f
SHA1

c8d319f9b036643f5a70824a7854006e19afdc1d
SHA256

1720df5bf6d025e40c11032cd8f3d7f28cda87c0e28701e94b4142f54540f824
SHA512

7a1f527a0e13d072d5a75d3df29bb05ad6a826c7c6c736fc6d85f301cc3c1b188d436cefa7d6a30c6bd7b4678969e6611cb2103133fe1a4a52eb19c0f8b79263
SSDEEP

12288:WH7B6IU0nXXEELWMGeS9p20JXqwcWePMU:ekmXUAWMGe8pdqwcR

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3020	5084	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 5084	4256	rundll32.exe	83
PID 4256 wrote to memory of 5084	4256	rundll32.exe	83
PID 4256 wrote to memory of 5084	4256	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ILUninstall.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ILUninstall.dll,#1
  2⤵
  PID:5084
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 640
    3⤵
    - Program crash
    PID:3020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5084 -ip 5084
1⤵
PID:1420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5084-0-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download