71b96d709cb160b579ec5010ce38b00084a49c420cd5945b69714dfc9acb811e | Triage

Analysis

max time kernel
139s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19-07-2024 10:06

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/StartMenu.dll
Size

7KB
MD5

4973362a84e11dd8541387ab1694afcc
SHA1

b78a0fe67c07713c7abd9668b881c4bc808d9a7a
SHA256

7757518466b21ce175607f10599f26fff127d59a16dc10bf4ba4b7d83d13d47d
SHA512

65c305eced5cd81fe3a573827d62a33e400f03d5bfcb3b3a503927bc0decaedef5d74e6d1ba25a0601fe812f8d2424887d58211c3f3cea1442643f5d1c23c2fb
SSDEEP

96:Z+nBC0x22epxPEvC4FkWE+in1/FMvsCGRfRFqCB5tLGhEl5VN:Z+BepxPE1r8/FtmCDtSg5v

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2960	3572	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 3572	4868	rundll32.exe	84
PID 4868 wrote to memory of 3572	4868	rundll32.exe	84
PID 4868 wrote to memory of 3572	4868	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#1
  2⤵
  PID:3572
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3572 -s 612
    3⤵
    - Program crash
    PID:2960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3572 -ip 3572
1⤵
PID:3276

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads