790695bf25129b28c2f7c1de1428bdf5db8acb34b3a1d38e41c72a80d7278069 | Triage

Analysis

max time kernel
37s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20-10-2022 22:56

Sharing

Report Analysis Logs

General

Target

kcftZUmITYgNCj.dll
Size

3.6MB
MD5

59e784a067345a37edb515c36f561c19
SHA1

102d63cb15a2b2a09408f6c9f216fb897b80d625
SHA256

501bd028925f20d7ebaca6b0ef50a90f0716579920df0b7aa2a44da862a06c68
SHA512

9b8778e40d100cbb76248b410eebe5fce9b07faee0d87f49c481ef70774be8a7a69847378f8f90a1ca0a5efaaef8cba9a1bdd96ca415f1276b22b8beef797faa
SSDEEP

49152:4DKZOp4/wXojetiGde8wzcVZWKOhGV1WqRqiW:UKZOp4/wttjE8NZWKOhGV1WqRqiW

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1580	1720	WerFault.exe	17

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 1580	1720	rundll32.exe	27
PID 1720 wrote to memory of 1580	1720	rundll32.exe	27
PID 1720 wrote to memory of 1580	1720	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\kcftZUmITYgNCj.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1720 -s 84
  2⤵
  - Program crash
  PID:1580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads