5ff1d8742f12a83e7691418b078394ce01c1d1acae2d5269abc80f07940376a4 | Triage

Analysis

max time kernel
177s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
31-07-2022 07:56

Sharing

Report Analysis Logs

General

Target

AHX26VNWHVDPF57JN4B27233L8.dll
Size

4.5MB
MD5

495e812df4d0ee7ed1324714bfb6ffef
SHA1

4e5ba8b4695bc60b272f7b60d342e48e440a4f7a
SHA256

9d9d3795c0df6d9098db13768ef6a3893d58ea1b7a9a1279b7ee15ed51d53028
SHA512

4088e84e436d701f87625b6393b07e0a18e210961d817ea8919e5f76bed5131ba9bb54f958fb212461e1461dbbe0d9178bae690412f6be771fb69c75f6f2cbe6

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
484	1476	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 752 wrote to memory of 1476	752	rundll32.exe	82
PID 752 wrote to memory of 1476	752	rundll32.exe	82
PID 752 wrote to memory of 1476	752	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AHX26VNWHVDPF57JN4B27233L8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:752
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\AHX26VNWHVDPF57JN4B27233L8.dll,#1
  2⤵
  PID:1476
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1476 -s 704
    3⤵
    - Program crash
    PID:484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1476 -ip 1476
1⤵
PID:3772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1476-131-0x0000000002400000-0x0000000002911000-memory.dmp

Filesize
5.1MB

Download