7c5b449226d2c3e8e65341baffb10b9393282d53b7f6fb164ed788ca2967bb99 | Triage

Analysis

max time kernel
141s
max time network
119s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
30-09-2024 23:59

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/StartMenu.dll
Size

11KB
MD5

65c301d9a85f4342cdef7fedeabafd5d
SHA1

10606ffc00f2400fb2f52d404b30115cb33137e9
SHA256

48765294aa273ec2fd55cc5f9301e138b4d56a9f6d00fcf24473788e64b52bfd
SHA512

0dcdd78d8f472168614200900afd479a60106c94deda18c9999c32b1af497c32d9fd41f6039d94bfa28855121e61fb4031e4464b2f074d9fb7024f5f74950efd
SSDEEP

192:fLB7OopThb4h9qRqsHUzKX9zvJkwTFkBo5BoE9c:fLB77pCh97s0zKZvaOc

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2336 wrote to memory of 2284	2336	rundll32.exe	WerFault.exe
PID 2336 wrote to memory of 2284	2336	rundll32.exe	WerFault.exe
PID 2336 wrote to memory of 2284	2336	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2336

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2336 -s 140
2⤵
PID:2284

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2336-0-0x000007FEFBA00000-0x000007FEFBA0D000-memory.dmp

Filesize
52KB

Download