ad0a858b676cde7b617db1832c5be47fbe650ef23f7ed00d028daa0f1179b30f | Triage

Analysis

max time kernel
182s
max time network
221s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2022, 22:57

Sharing

Report Analysis Logs

General

Target

KEYMAKE/INCLUDE/MSPDB50.dll
Size

153KB
MD5

97f4325565d19f5d08e24c32464eb073
SHA1

97829e0a61fac69b42cbf64dd8e640cd9941c78b
SHA256

f3b6fd55b6d7816156b414931428bdcdcd8e8861e1be00e331bccdf7d35d10ba
SHA512

7ae31fa198ffceda21b68dd3a070147a618aa7ed6bc95213c8417d09c48c65da22fb43831edf80ef350bc8347fc3d2ecf417cd0f7a588500b6b140e55e0ae1f6
SSDEEP

3072:n17UDgOV9UkTRtA5kLh27sAcjXjB9aKxbPsWDQe/KFW:nx8ea6kf3iKlsaQW

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4788	4820	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 4820	2112	rundll32.exe	82
PID 2112 wrote to memory of 4820	2112	rundll32.exe	82
PID 2112 wrote to memory of 4820	2112	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\KEYMAKE\INCLUDE\MSPDB50.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\KEYMAKE\INCLUDE\MSPDB50.dll,#1
  2⤵
  PID:4820
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 612
    3⤵
    - Program crash
    PID:4788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 4820 -ip 4820
1⤵
PID:220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads