c74873d7b8cc622379ed49bd0b0e477167ae176aa329b01338666ec4c1a4426b | Triage

Resubmissions

03/11/2022, 09:46

221103-lrnd1sghc5 3

22/09/2022, 15:06

220922-sgtavafedj 3

14/10/2021, 16:48

211014-vbeavaaad5 8

22/09/2021, 05:58

210922-gpdpksecgk 8

22/09/2021, 05:36

210922-gax5nsecdn 8

Analysis

max time kernel
60s
max time network
65s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
22/09/2022, 15:06

Sharing

Report Analysis Logs

General

Target

manual64.dll
Size

184KB
MD5

d35a5caf8af43432ec2f5a2318b20597
SHA1

8fd8f62a848a1d9c1ff18c7bc16e8a6d2c67c37e
SHA256

c74873d7b8cc622379ed49bd0b0e477167ae176aa329b01338666ec4c1a4426b
SHA512

7de9c021c2e64c564ba8ac5c0f1914718c240a382bc717dd7e93122a0a51c849c263ae0438eae5c324ca1e5c3d346c2a09ab7fc63bbaa598e3973943a5d84263
SSDEEP

3072:y3hqOnUKeCBHq5l2GI3NamwWkh2gaER+680q2t1X7LrruiBHta:JYj1iaNamwWk08U68qw

Score

3^/10

Malware Config

Signatures

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2064	1584	WerFault.exe	28
2296	2268	WerFault.exe	112

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 2268	2788	cmd.exe	112
PID 2788 wrote to memory of 2268	2788	cmd.exe	112

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\manual64.dll,#1
1⤵
PID:1584
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1584 -s 232
  2⤵
  - Program crash
  PID:2064

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 452 -p 1584 -ip 1584
1⤵
PID:3780

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:456

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Windows\system32\rundll32.exe
  rundll32 C:\Users\Admin\AppData\Local\Temp\manual64.dll,#1
  2⤵
  PID:2268
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 2268 -s 224
    3⤵
    - Program crash
    PID:2296

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 468 -p 2268 -ip 2268
1⤵
PID:424

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads