ae7ed87ad80d0ebae1bde19aabc11e1480417a0f93519be467eb921f7effee00 | Triage

Analysis

max time kernel
41s
max time network
47s
platform
windows7_x64
resource
win7-20220414-en
submitted
24/06/2022, 20:52

Sharing

Report Analysis Logs

General

Target

m3n4rat.dll
Size

1.8MB
MD5

b8d3dc61da66d69907564677aea251cc
SHA1

eed926865a663bcd865a6554ea2c99e2f52224db
SHA256

fa4b97cf11ee55b707afad61122104649117f2cc71f700e908d7f18f70ab1f78
SHA512

dce4b4166fab61c1c1b970aad678ecb7650b23fa355bbb7847d0fbaf7714466329f73111ba7bc28cad4a0f73f17d4438dee37e56f19f4f17b0787b7a16c51037

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
848	1036	WerFault.exe	13

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 848	1036	rundll32.exe	28
PID 1036 wrote to memory of 848	1036	rundll32.exe	28
PID 1036 wrote to memory of 848	1036	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\m3n4rat.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1036 -s 84
  2⤵
  - Program crash
  PID:848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads