86fbeba0e3564f8dd1b37260fa0e1d5dcc30466ef17c02e41eb41c46f09762e0 | Triage

Analysis

max time kernel
41s
max time network
47s
platform
windows7_x64
resource
win7-20220414-en
submitted
21/06/2022, 18:49

Sharing

Report Analysis Logs

General

Target

s3negar.dll
Size

1.6MB
MD5

e96805cad0ee3a8fe51a1f15755d62cc
SHA1

c597e13cb44cebf5401ccb56e92ef64c18128e34
SHA256

262cb83dca4b482b1fb74e10c0eb5e668ba605081d5d42d559e80b864de8c3e3
SHA512

b1c45021f018ccf2a2e100aabb770bfc047388b991d3e4547651ee69ccdf66de6393e668e985b612f552fdc1ba137b636100f9259082c17682844456d149d3bf

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1580	1092	WerFault.exe	22

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 1580	1092	rundll32.exe	28
PID 1092 wrote to memory of 1580	1092	rundll32.exe	28
PID 1092 wrote to memory of 1580	1092	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\s3negar.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1092 -s 84
  2⤵
  - Program crash
  PID:1580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads