584d1a787374e437b050149ee9e1f891496db0d5e1f86bc08c1c3f003143bb80 | Triage

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04-11-2022 21:01

Sharing

Report Analysis Logs

General

Target

aMLjTIhBvevLGx.dll
Size

997KB
MD5

59dc887601cbaaead82bfe63e5e38340
SHA1

77f4828ed6eaf990c2d3e50c0b6f041519d52a2d
SHA256

54752a51b0024f0cf90d7cab52f97cc7798fd5bda8e03b9ade44ee45638dbe8e
SHA512

041fb2a37793630683cdfbe7538fc6a44d4550a21b67df3b24147d72001d01d3898c79db210311aebd913854cb3647de23b2599e945a9ef3004906c68bf0d714
SSDEEP

24576:gOaBNP2MOnriAaG4tmHjf6wv2nybJpxm9EsYqdwu:gOaH2MOrf/4tQ3J7mcq

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1416	900	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 1416	900	rundll32.exe	27
PID 900 wrote to memory of 1416	900	rundll32.exe	27
PID 900 wrote to memory of 1416	900	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aMLjTIhBvevLGx.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 900 -s 84
  2⤵
  - Program crash
  PID:1416

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads