75d58879e9101fe2925a81f56afbfc7541e7d8c2aa8aa6ffac3142c4fa63bfa3 | Triage

Analysis

max time kernel
204s
max time network
220s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 22:52

Sharing

Report Analysis Logs

General

Target

Data/Rome_Win.dll
Size

656KB
MD5

c04fce9755caea035963a4626a5246d5
SHA1

04cad00e9c98d6b786c55bb987e14c2031b004ed
SHA256

62a42318d97c04e5f13ae91d91806b847acdd337846c28fec0422173701a0c6f
SHA512

b65cd642ec01623b52f3cf15b58998fb4dbc77568371ab7d1f1a10b06fc9d6e5fcba1e660f87ebc3b31debac227ac26e1c8cf01a09e178db0ff3ec73449e08c0
SSDEEP

6144:ERSkC363So3vUKuOx9jBgRxhQK5Cg8l0O2glmThScy8a+FkVj394/S:E0No/UKuObYuOOtmFbYUQ3uS

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
208	3472	WerFault.exe	83

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3472	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 3472	4888	rundll32.exe	83
PID 4888 wrote to memory of 3472	4888	rundll32.exe	83
PID 4888 wrote to memory of 3472	4888	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\Rome_Win.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\Rome_Win.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3472
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3472 -s 700
    3⤵
    - Program crash
    PID:208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3472 -ip 3472
1⤵
PID:4088

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads