10df554cb7248b3b04b8080cdd14494f1cdc5d5b838d73edc5778dc5d15f7096 | Triage

Analysis

max time kernel
134s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
14-03-2022 20:42

Sharing

Report Analysis Logs

General

Target

10df554cb7248b3b04b8080cdd14494f1cdc5d5b838d73edc5778dc5d15f7096.dll
Size

208KB
MD5

122a89630ff881941bd27981993bea19
SHA1

d7d61a333b857df377509201570102768a3bb60e
SHA256

10df554cb7248b3b04b8080cdd14494f1cdc5d5b838d73edc5778dc5d15f7096
SHA512

db156f3154709457f47c42a1da36217fb63496a096e2f5169fc2d90ae33bdf038b7aad7c3126f30b80dfd008b4730c9b9c55dda09d18c4c0ef1d70ee48ccb8e4

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4792 3688 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2816 wrote to memory of 3688	2816	rundll32.exe	rundll32.exe
PID 2816 wrote to memory of 3688	2816	rundll32.exe	rundll32.exe
PID 2816 wrote to memory of 3688	2816	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\10df554cb7248b3b04b8080cdd14494f1cdc5d5b838d73edc5778dc5d15f7096.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2816

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\10df554cb7248b3b04b8080cdd14494f1cdc5d5b838d73edc5778dc5d15f7096.dll,#1
2⤵
PID:3688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 680
3⤵
- Program crash
PID:4792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3688 -ip 3688
1⤵
PID:3820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...