48e05c23d91e27c7bcf3270926956e8f92edf02dcae83d0266ce78da67f8844b | Triage

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20-07-2024 05:28

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/UAC.dll
Size

17KB
MD5

8181aa2048ff525110728d83a313294e
SHA1

055b1ce1b195dce54d7941094f6155a6e2420f02
SHA256

ae96e7a95d8d5e50c425ea2b0b309aca9223b45d9cdc344681aa7e77007d5d65
SHA512

0486bcc4d7a657f9ccb96dca3b348bf0d2d09b9f30e5db3731d7f1dd8ea4ad8a5b20b98ba2316a5579d0434bd2e348ae48bd8b741165ddbc4440ad4b9c7ad7b3
SSDEEP

384:59TzaeW+WyB8c7LX+OGkrtqkysGEB2hA9Xk88:5ZaB+W62MrzQwk8

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
456	3944	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 3944	2296	rundll32.exe	84
PID 2296 wrote to memory of 3944	2296	rundll32.exe	84
PID 2296 wrote to memory of 3944	2296	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UAC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UAC.dll,#1
  2⤵
  PID:3944
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 560
    3⤵
    - Program crash
    PID:456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3944 -ip 3944
1⤵
PID:1144

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads