a3cd08afd7317d1619fba83c109f268b4b60429b4eb7c97fc274f92ff4fe17a2 | Triage™

Resubmissions

07/07/2022, 09:42

220707-lpq25abdhr3

13/04/2022, 09:03

220413-kz15eaead23

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220331-en
submitted
13/04/2022, 09:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a3cd08afd7317d1619fba83c109f268b4b60429b4eb7c97fc274f92ff4fe17a2.dll
Size 95KB
Sample220413-kz15eaead2
SHA256 a3cd08afd7317d1619fba83c109f268b4b60429b4eb7c97fc274f92ff4fe17a2
MD5 57a22e74ba27b034613b0c6ac54a10d5
SHA1 c1d312762d598831d431b08e47075047582856aa
SHA512 f319d5bf967005ec2b4a86e84f2188f321a8994480687c81645a5c7ff1b69450cf1f78182c9658618c74886de8efa7380c5043d74c61d023b1903fcd3b187740
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1060	1720	WerFault.exe	13

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 1060	1720	rundll32.exe	28
PID 1720 wrote to memory of 1060	1720	rundll32.exe	28
PID 1720 wrote to memory of 1060	1720	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3cd08afd7317d1619fba83c109f268b4b60429b4eb7c97fc274f92ff4fe17a2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1720 -s 92
  2⤵
  - Program crash
  PID:1060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads