4a36a1af9e16ea478ee8901de696d359362cd5a1debecdd7211659113db85328 | Triage

Analysis

max time kernel
93s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
14-10-2022 05:57

Sharing

Report Analysis Logs

General

Target

45d5d6fe1ce8d8ebac7a35f323221e83.dll
Size

2.7MB
MD5

45d5d6fe1ce8d8ebac7a35f323221e83
SHA1

f26aef3ee98afef8e1228bd05e0db1cff933b5f0
SHA256

4a36a1af9e16ea478ee8901de696d359362cd5a1debecdd7211659113db85328
SHA512

4e5884185c2631789230f3dc3a4fa52bd0141b320ec514c83866a1c492371c7b8b77a44822bfcf809420509799ccbe98aba2a2947efcb80096c030e4a64aba92
SSDEEP

49152:Jzl1rpbUrqvv0v2rQVt8nqwI7lOOYcH2ek:P1Kqvv07noI7lOOYcR

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4952	1440	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1232 wrote to memory of 1440	1232	rundll32.exe	81
PID 1232 wrote to memory of 1440	1232	rundll32.exe	81
PID 1232 wrote to memory of 1440	1232	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\45d5d6fe1ce8d8ebac7a35f323221e83.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\45d5d6fe1ce8d8ebac7a35f323221e83.dll,#1
  2⤵
  PID:1440
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1440 -s 568
    3⤵
    - Program crash
    PID:4952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1440 -ip 1440
1⤵
PID:5104

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads