68fdb41c691ceb43c69cd409a086c687b813c0b1d5d1b8e8a3b612ee4646e1a5 | Triage

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/09/2022, 19:22

Sharing

Report Analysis Logs

General

Target

iyXaimiAupRils.dll
Size

2.4MB
MD5

0ec0f3a857810ad082d8df86aef72250
SHA1

2ba93d61975b752c55f685920d68632cb08476fb
SHA256

9fe39ac91448cc12f2e9050dd81844ba630db20e7ad63c7c124242c68ac4f23b
SHA512

4b7b6536555749050f24fefc69dcfb5728de6ffbf6ce69e12d9883b783298f5156895aad9b8d036c9f7520cb9a5136863aa16a4a3e4e82862c7e5b80f69a0455
SSDEEP

49152:xQSHFuj7kV1RjKx55USO8SA7BpdEB2dPQMo6qMXgzOMfk:2SHw7kV1RhSO8Sc+sQMHq9Bf

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
540	1048	WerFault.exe	20

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 540	1048	rundll32.exe	27
PID 1048 wrote to memory of 540	1048	rundll32.exe	27
PID 1048 wrote to memory of 540	1048	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\iyXaimiAupRils.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1048 -s 84
  2⤵
  - Program crash
  PID:540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads