f533f98a7ffad645b043ccb7fc806bb13f69c60229cfde5eec04a04bf758d6ae | Triage

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01-11-2022 20:59

Sharing

Report Analysis Logs

General

Target

XzdVAVxwxRDMJS.dll
Size

883KB
MD5

24c6fb77f304a94bb815974915f28911
SHA1

db32739319f779d09ab34b21fc16cb0b5a319575
SHA256

fe9eb87723493d36d843b689ddbebf8a1bc634da867d85bae7068e2176b034fb
SHA512

8ee9add01406cd8004599ba1f32b0f89c8ed0a0328bfe0a52e8e61d80e484c3e2c9e8eacdc70c846a06993c84db1dc7ea6c4dbe21bdffec0c45d62bad1732da2
SSDEEP

24576:QOpVeLbkxqoAet8iMvJNOZ3tKcwet4jJklGil:QuVeLwai0OZgcwetdB

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
948	2024	WerFault.exe	26

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 948	2024	rundll32.exe	27
PID 2024 wrote to memory of 948	2024	rundll32.exe	27
PID 2024 wrote to memory of 948	2024	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\XzdVAVxwxRDMJS.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2024 -s 84
  2⤵
  - Program crash
  PID:948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads