4a2d9062985debbff2494e158c66f26fe95d61a48900c47ff7a744d012e6f576 | Triage

Analysis

max time kernel
91s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23/10/2022, 17:47

Sharing

Report Analysis Logs

General

Target

09069ada2901baf7354f44d097996698.dll
Size

2.7MB
MD5

09069ada2901baf7354f44d097996698
SHA1

32cef9ae388d149495d48d840377eb3d20803b48
SHA256

4a2d9062985debbff2494e158c66f26fe95d61a48900c47ff7a744d012e6f576
SHA512

c8ec99606e5d67f2297cdbb9b68a4c88fd373b361bea4edc0065fc8b26e58442bc0491c815cf85bb3bd81f1b5d5dab6cc0a4d88682697c404534f4a7c438f1f6
SSDEEP

49152:Jzl1rpbUrqvv0v2rQVt8nqwI7lOOYc52ek:P1Kqvv07noI7lOOYcL

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
752	2040	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 2040	4768	rundll32.exe	81
PID 4768 wrote to memory of 2040	4768	rundll32.exe	81
PID 4768 wrote to memory of 2040	4768	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\09069ada2901baf7354f44d097996698.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\09069ada2901baf7354f44d097996698.dll,#1
  2⤵
  PID:2040
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 560
    3⤵
    - Program crash
    PID:752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2040 -ip 2040
1⤵
PID:4452

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads