a8c453e85ccd4ca6a99e83036a736cc904b1b96b4a78d4e33c50c31136226a7a | Triage

Resubmissions

08-07-2022 07:45

220708-jlnrgshhg3 10

08-07-2022 07:38

220708-jgdeyshfc9 10

08-07-2022 07:36

220708-jfkgwafedq 10

08-07-2022 07:30

220708-jb7fvafdaj 10

Analysis

max time kernel
150s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
08-07-2022 07:30

Sharing

Report Analysis Logs

General

Target

boot_00430000.dll
Size

75KB
MD5

0ea80c1fd7481bc1fbfe86470069ec81
SHA1

6aaed5570b9af39ae45c43367d0cfa67c7199e42
SHA256

a8c453e85ccd4ca6a99e83036a736cc904b1b96b4a78d4e33c50c31136226a7a
SHA512

1a01e86a5901829e79bd8d625119cbb562228ccd0527bf17bb213209489937fa0bd4987171deaca88c434fb368831e3ee9a6a779be6d28662e4e57cfb7f40e5a

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2836 5068 WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 400 wrote to memory of 2424	400	rundll32.exe	rundll32.exe
PID 400 wrote to memory of 2424	400	rundll32.exe	rundll32.exe
PID 400 wrote to memory of 2424	400	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\boot_00430000.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:400

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\boot_00430000.dll,#1
2⤵
PID:2424

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4352

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 436 -p 5068 -ip 5068
1⤵
PID:3752

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 5068 -s 1096
1⤵
- Program crash
PID:2836

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2424-130-0x0000000000000000-mapping.dmp

Download