a88f219f05f15f07bd6f09dbdb300678c7014a4e2c13f1969effd4581be6575d | Triage

Analysis

max time kernel
41s
max time network
44s
platform
windows7_x64
resource
win7-20220414-en
submitted
24/06/2022, 14:14

Sharing

Report Analysis Logs

General

Target

m3n4rat.dll
Size

1.8MB
MD5

84256f758cd030426fd4103fc55eae94
SHA1

2a5d525d280cc7c25009736d91dc552b2d8fb9d4
SHA256

353d2a5e23e7ce6d31860fc0dfdcb8a1b200299fe899a021a3dda11b9d6f312a
SHA512

e5d631fa44a818c27a4c66ba311f92d661c127fa29bebef036b172493999e4b2a592126f4d5cdd050076001aee3304a196dc079f10f69f27735501db9d271f02

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2016	1216	WerFault.exe	20

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 2016	1216	rundll32.exe	28
PID 1216 wrote to memory of 2016	1216	rundll32.exe	28
PID 1216 wrote to memory of 2016	1216	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\m3n4rat.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1216 -s 84
  2⤵
  - Program crash
  PID:2016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads