4181493b278e44b14fb74ea295dac5327f4146691d486161d0cb57ccdc72b730 | Triage

Analysis

max time kernel
3s
max time network
192s
platform
windows7_x64
resource
win7-20220414-en
submitted
24/06/2022, 22:46

Sharing

Report Analysis Logs

General

Target

m3n4rat.dll
Size

1.8MB
MD5

e5ebaf4ada3d509bf73b65959f0ea28a
SHA1

9fe44592e984df4b91156c451a6d00bbde58c764
SHA256

51fb297b5bddffaed6620744ebc5e32a97b610ac0a4fc4635b0eb1967f543fa4
SHA512

9278ed3c771e77b9460054ed1993b74e3cde25cf0e4c4cf243e88143a3ac9d3014f4405e27aeeec2f22a5a72abda0d7138992ca12154bde193841f0e3f922bc4

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1260	1972	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 1260	1972	rundll32.exe	28
PID 1972 wrote to memory of 1260	1972	rundll32.exe	28
PID 1972 wrote to memory of 1260	1972	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\m3n4rat.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1972 -s 84
  2⤵
  - Program crash
  PID:1260

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads