3fd9e3d39ab9bd5454b80daeef3f445fe20cdc93f0d6d686d5ce3b13d80702b7 | Triage

Analysis

max time kernel
44s
max time network
47s
platform
windows7_x64
resource
win7-20220414-en
submitted
24/06/2022, 20:28

Sharing

Report Analysis Logs

General

Target

m3n4rat/m3n4rat.dll
Size

1.8MB
MD5

4b71fc8e3a2849d9fe51cba2d358b1bb
SHA1

1f3c1c27daba5670476e93055fc2a15e05b43c16
SHA256

ab2bd1f1f033acabd85b1d30218dcb1824a1c151a41ead3f876c11930f6306db
SHA512

894f0a0b21ea145f48bb3313376829b74205d4eac5ab2a07d33dfe0121a68f527ca880b7c0fe7b46e4abe460921963c73badde462dc80211c9f8af15559dd1bd

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1984	1956	WerFault.exe	25

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 1984	1956	rundll32.exe	27
PID 1956 wrote to memory of 1984	1956	rundll32.exe	27
PID 1956 wrote to memory of 1984	1956	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\m3n4rat\m3n4rat.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1956 -s 84
  2⤵
  - Program crash
  PID:1984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads