d885c21de4dec53116d41f097f8c538e72ed7a9c967fa5d47e9e800fcc79c5ca | Triage

Analysis

max time kernel
38s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
12/09/2022, 18:18

Sharing

Report Analysis Logs

General

Target

submit/enchanting.dll
Size

2.8MB
MD5

dc7992c5d6c2518464ee8d8f2c509b32
SHA1

d8866baf07a5dab2f407439ca5f7909e2bb6c461
SHA256

d11d07a44788e6b71ff138b96caeb4e81adbbcceee74ac809264bfae7667ed66
SHA512

e11630d07d2a9bc53c7ec4812c7b09ac961d808c08b433225b3920d11e89f752109038f7d6d1e630e8e01b21be51ac8451ce46c7e33dc4cd9d75b1bcb8272180
SSDEEP

49152:UB6vxhwKXnR/Be0qCUrBdBhs64cOYjBNMHmug7Lx:UB6vxhgAYDMgLx

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1988	544	WerFault.exe	25

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 544 wrote to memory of 1988	544	rundll32.exe	26
PID 544 wrote to memory of 1988	544	rundll32.exe	26
PID 544 wrote to memory of 1988	544	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\submit\enchanting.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:544
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 544 -s 84
  2⤵
  - Program crash
  PID:1988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads