746de725b958eb6dc30b836114a79cb0071fda04a15dcc938a6ced5586de25d0 | Triage

Analysis

max time kernel
42s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 09:38

Sharing

Report Analysis Logs

General

Target

ipacc/istat.dll
Size

92KB
MD5

26cfb12edce6878f9a516eb40dd5f324
SHA1

73f17efdd35929ae46c691a3e7c892307e4b6301
SHA256

ddb58c425008c68ae08db34519bb5d27a6933f2373629885fb79e8d4398d78b8
SHA512

a650f38c2a3cfd1a0cac501cecb3359533341765b7a82cfa1289db242e27cb2298bc9e1674bf05920b1957ff784a7fa9087df2e02e3af2a54a0f0610bc3f1d0f
SSDEEP

1536:A0qiiCCTyYeS3fTdYdu8oQA2JYrof/gjOB8GZOLaD0hBrRIj:A0pSO+A5zZRABrRo

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

884 1616 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 940 wrote to memory of 1616	940	rundll32.exe	rundll32.exe
PID 940 wrote to memory of 1616	940	rundll32.exe	rundll32.exe
PID 940 wrote to memory of 1616	940	rundll32.exe	rundll32.exe
PID 940 wrote to memory of 1616	940	rundll32.exe	rundll32.exe
PID 940 wrote to memory of 1616	940	rundll32.exe	rundll32.exe
PID 940 wrote to memory of 1616	940	rundll32.exe	rundll32.exe
PID 940 wrote to memory of 1616	940	rundll32.exe	rundll32.exe
PID 1616 wrote to memory of 884	1616	rundll32.exe	WerFault.exe
PID 1616 wrote to memory of 884	1616	rundll32.exe	WerFault.exe
PID 1616 wrote to memory of 884	1616	rundll32.exe	WerFault.exe
PID 1616 wrote to memory of 884	1616	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ipacc\istat.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:940

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ipacc\istat.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1616 -s 228
3⤵
- Program crash
PID:884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/884-56-0x0000000000000000-mapping.dmp

Download
memory/1616-54-0x0000000000000000-mapping.dmp

Download
memory/1616-55-0x00000000760A1000-0x00000000760A3000-memory.dmp

Filesize
8KB

Download