f8ae0a8e7770dd0e3e68cf99b2d9e5d7152a39ca788e2ddfcf93b2118e4649c4 | Triage

Analysis

max time kernel
182s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 18:20

Sharing

Report Analysis Logs

General

Target

FastVerCode.dll
Size

84KB
MD5

4ef099b36c081359c032182555f545a6
SHA1

f6169d4ddac782a092b43f304e188788986cbc9a
SHA256

7041867ea7411edd838530d9ff7552d47022bac64d5fdafcb243d703eae4b9e7
SHA512

2bea41476ee531ff01af7b5eb858d5eaadaf99dd4545157550898af3b85a70165d3877c7bbe170bf702646286b6c72adeabd629b9206a0b04c3753a5b489dbaf
SSDEEP

1536:Pz2MDZizaHLDykP+LOdtPnmdGd2Kt7wAqoBUAJ:b2MYOHKkGLOdFmNdAqgUAJ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4360	4588	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 4588	2196	rundll32.exe	81
PID 2196 wrote to memory of 4588	2196	rundll32.exe	81
PID 2196 wrote to memory of 4588	2196	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\FastVerCode.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\FastVerCode.dll,#1
  2⤵
  PID:4588
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 624
    3⤵
    - Program crash
    PID:4360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4588 -ip 4588
1⤵
PID:4840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads