c8a5e02417285b85da288818cca8a6900122011890fa92c9053787dfb195b8c6 | Triage

Resubmissions

13-09-2022 06:25

220913-g6tr5aafem 10

13-09-2022 06:22

220913-g48s9seha8 5

12-09-2022 18:09

220912-wrkcgahefn 3

Analysis

max time kernel
41s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
12-09-2022 18:09

Sharing

Report Analysis Logs

General

Target

sample/son/enchanting.dll
Size

2.8MB
MD5

dc7992c5d6c2518464ee8d8f2c509b32
SHA1

d8866baf07a5dab2f407439ca5f7909e2bb6c461
SHA256

d11d07a44788e6b71ff138b96caeb4e81adbbcceee74ac809264bfae7667ed66
SHA512

e11630d07d2a9bc53c7ec4812c7b09ac961d808c08b433225b3920d11e89f752109038f7d6d1e630e8e01b21be51ac8451ce46c7e33dc4cd9d75b1bcb8272180
SSDEEP

49152:UB6vxhwKXnR/Be0qCUrBdBhs64cOYjBNMHmug7Lx:UB6vxhgAYDMgLx

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2032	1116	WerFault.exe	25

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 2032	1116	rundll32.exe	26
PID 1116 wrote to memory of 2032	1116	rundll32.exe	26
PID 1116 wrote to memory of 2032	1116	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\sample\son\enchanting.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1116 -s 84
  2⤵
  - Program crash
  PID:2032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads