4882da2347294c3b4fb9f60b87a78b4ad15ec950ee2b9c82b30ab5acdb2db9a4 | Triage

Analysis

max time kernel
90s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
14-10-2022 05:58

Sharing

Report Analysis Logs

General

Target

53c6a285218e7b8a6f8b75a8ce6eb97d.dll
Size

2.7MB
MD5

53c6a285218e7b8a6f8b75a8ce6eb97d
SHA1

2fe41b5ca48147d105276b74c75f06c9fae4e0d7
SHA256

4882da2347294c3b4fb9f60b87a78b4ad15ec950ee2b9c82b30ab5acdb2db9a4
SHA512

294fd9085237e119283fad60ff409cc49a4fc189ce4becbc63e4ad4a9cac07528701e084320bd1db51b17a219c52b218dfcc5bda24df742fdbb89f35328c8222
SSDEEP

49152:Jzl1rpbUrqvv0v2rQVt8nqwI7lOOYc/2ek:P1Kqvv07noI7lOOYcJ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2580	4744	WerFault.exe	77

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 4744	1300	rundll32.exe	77
PID 1300 wrote to memory of 4744	1300	rundll32.exe	77
PID 1300 wrote to memory of 4744	1300	rundll32.exe	77

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\53c6a285218e7b8a6f8b75a8ce6eb97d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\53c6a285218e7b8a6f8b75a8ce6eb97d.dll,#1
  2⤵
  PID:4744
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4744 -s 564
    3⤵
    - Program crash
    PID:2580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4744 -ip 4744
1⤵
PID:1804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads