3e8496d466703e8d0a532d3dd9aada3998ca2f26ab3fbee326afccd8949f6f2e | Triage

Analysis

max time kernel
146s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
01-07-2022 07:01

Sharing

Report Analysis Logs

General

Target

3e8496d466703e8d0a532d3dd9aada3998ca2f26ab3fbee326afccd8949f6f2e.dll
Size

199KB
MD5

9515b6e90aa04762b8b703e85ce299ef
SHA1

6cf80fc2731d81d966396c12fbc92f7b88dbaafb
SHA256

3e8496d466703e8d0a532d3dd9aada3998ca2f26ab3fbee326afccd8949f6f2e
SHA512

4db0f1a558b78d072c4113c35d2bc3e237e0d241173cef80d5e727400ae16094226d8bb8cbb82d1aa6a13dd6cefb9cb190aa457754ae8474000fea48fef0cccc

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4496 2996 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4640 wrote to memory of 2996	4640	rundll32.exe	rundll32.exe
PID 4640 wrote to memory of 2996	4640	rundll32.exe	rundll32.exe
PID 4640 wrote to memory of 2996	4640	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e8496d466703e8d0a532d3dd9aada3998ca2f26ab3fbee326afccd8949f6f2e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4640

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3e8496d466703e8d0a532d3dd9aada3998ca2f26ab3fbee326afccd8949f6f2e.dll,#1
2⤵
PID:2996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 680
3⤵
- Program crash
PID:4496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2996 -ip 2996
1⤵
PID:1748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2996-130-0x0000000000000000-mapping.dmp

Download