7a2683840274bac37c4d8d2227a585d1ceb5b86f2a5c621aea5109ce736b3918 | Triage

Analysis

max time kernel
101s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
14-10-2022 05:57

Sharing

Report Analysis Logs

General

Target

171ec48cec3496c382bb8c683a816fcc.dll
Size

2.7MB
MD5

171ec48cec3496c382bb8c683a816fcc
SHA1

ae9eaac968470efa6d3af3c5872842fa18049b96
SHA256

7a2683840274bac37c4d8d2227a585d1ceb5b86f2a5c621aea5109ce736b3918
SHA512

d94b8ffd706217d86291f48b4207506e4e1b4c2818be17584d6cb453d1732330f71baf98152896c769e87ff19fdb2f1ef8a9d00637ce24c90e006bfffe6c7d23
SSDEEP

49152:Jzl1rpbUrqvv0v2rQVt8nqwI7lOOYcZ2ek:P1Kqvv07noI7lOOYcr

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3616	2220	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 2220	2920	rundll32.exe	83
PID 2920 wrote to memory of 2220	2920	rundll32.exe	83
PID 2920 wrote to memory of 2220	2920	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\171ec48cec3496c382bb8c683a816fcc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\171ec48cec3496c382bb8c683a816fcc.dll,#1
  2⤵
  PID:2220
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 560
    3⤵
    - Program crash
    PID:3616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2220 -ip 2220
1⤵
PID:3904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads