746de725b958eb6dc30b836114a79cb0071fda04a15dcc938a6ced5586de25d0 | Triage

Analysis

max time kernel
184s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 09:38

Sharing

Report Analysis Logs

General

Target

ipacc/istat.dll
Size

92KB
MD5

26cfb12edce6878f9a516eb40dd5f324
SHA1

73f17efdd35929ae46c691a3e7c892307e4b6301
SHA256

ddb58c425008c68ae08db34519bb5d27a6933f2373629885fb79e8d4398d78b8
SHA512

a650f38c2a3cfd1a0cac501cecb3359533341765b7a82cfa1289db242e27cb2298bc9e1674bf05920b1957ff784a7fa9087df2e02e3af2a54a0f0610bc3f1d0f
SSDEEP

1536:A0qiiCCTyYeS3fTdYdu8oQA2JYrof/gjOB8GZOLaD0hBrRIj:A0pSO+A5zZRABrRo

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2544 1268 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4740 wrote to memory of 1268	4740	rundll32.exe	rundll32.exe
PID 4740 wrote to memory of 1268	4740	rundll32.exe	rundll32.exe
PID 4740 wrote to memory of 1268	4740	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ipacc\istat.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4740

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ipacc\istat.dll,#1
2⤵
PID:1268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 600
3⤵
- Program crash
PID:2544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 1268 -ip 1268
1⤵
PID:5080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1268-132-0x0000000000000000-mapping.dmp

Download