e731a9904849499018e7761354c7eee9ffd8bd68f32a4eaad75311e342066ac7 | Triage

Analysis

max time kernel
46s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
17/11/2022, 20:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

aBZbMXVgKCtmcQ.dll
Size

971KB
MD5

6b4fa6726408b86d6c333ae84cb7bbd8
SHA1

cb369faa465918e8c88fe9eae9c6f4fec5045dc0
SHA256

10acbfaf8c4cb43320e5bf75c817ddc57cb21ae74a59b40dfbee8da924027d06
SHA512

84e0e031766d630b8143817fb9635fac45c97a3ea6a3374f5ab8562a904c6984df225503ebf6a059f67bc704d165b0ee159e383218daa28d3d21368963d5f62f
SSDEEP

24576:fiSyxKLkWI3do0gTN39pTs/85igpszAMCRdIW:KSyoLtWG0+s/85rOze0

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
828	1200	WerFault.exe	22

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 828	1200	rundll32.exe	27
PID 1200 wrote to memory of 828	1200	rundll32.exe	27
PID 1200 wrote to memory of 828	1200	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aBZbMXVgKCtmcQ.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1200 -s 84
  2⤵
  - Program crash
  PID:828

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads