7c5b449226d2c3e8e65341baffb10b9393282d53b7f6fb164ed788ca2967bb99 | Triage

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-09-2024 23:59

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/System.dll
Size

25KB
MD5

46de30b73f6fa1d4ef62ba7b169e0191
SHA1

59850382f1f5f30c840f502d8fc5fc228df33d6d
SHA256

322e35bcdd0dd61cad8810bb446c425d8b91ceeba897b13fa0f50f1f48f88056
SHA512

2e51a23297bbe74bb1b1ecc5a7257c546ea43d864e0691a437577431d022f6be5e653dc1ce186698095833245c869bb769c7088ece85851f539b9b763b2cef70
SSDEEP

384:1xnVPk9nL3P0CMxzPJJKZvZvUq5PKpkuKnbyFJVA+:1lBkhP0CMxFwpSkUJ

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1972 wrote to memory of 2196	1972	rundll32.exe	WerFault.exe
PID 1972 wrote to memory of 2196	1972	rundll32.exe	WerFault.exe
PID 1972 wrote to memory of 2196	1972	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1972

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1972 -s 112
2⤵
PID:2196

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1972-0-0x000007FEFB1B0000-0x000007FEFB1BF000-memory.dmp

Filesize
60KB

Download