c40e825d90e9da117b13b4116135abf326644feb417392cd3fe2adc6a7976e80 | Triage

Analysis

max time kernel
32s
max time network
47s
platform
windows7_x64
resource
win7-20220414-en
submitted
21/06/2022, 17:38

Sharing

Report Analysis Logs

General

Target

s3negar.dll
Size

1.6MB
MD5

5ffb7b6b8fd8998a33f9c56a07e5c097
SHA1

2b00d9bd48d025fdbfea9f2957e964f15ffaa1f4
SHA256

983ff2cfee5f4d8489f04a955148148d5060c64a2673acb538a8fc2d29fe7c13
SHA512

ebbaf344d91189e64c8b60466f3fc795556ad645ebefdb4f71e294926507bfea4ee8db5e2ec65c9068660cdd24256411c0af8bea8cc1845dbb389b22b0f851c2

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1648	1912	WerFault.exe	26

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 1648	1912	rundll32.exe	27
PID 1912 wrote to memory of 1648	1912	rundll32.exe	27
PID 1912 wrote to memory of 1648	1912	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\s3negar.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1912 -s 84
  2⤵
  - Program crash
  PID:1648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads