Analysis

  • max time kernel
    137s
  • max time network
    172s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/11/2022, 13:32

General

  • Target

    eebd0f2ab7ef40775dea11dbfa57c1b4c671b700a9b89175fe5b11b0c0a27f59.dll

  • Size

    106KB

  • MD5

    6ae956e793b2b8f16ea402d695b8c660

  • SHA1

    c7d22be8cb35db1c494c4a8e2154055687d96445

  • SHA256

    eebd0f2ab7ef40775dea11dbfa57c1b4c671b700a9b89175fe5b11b0c0a27f59

  • SHA512

    1c1f9326941dff1fe30a8c901c77c50f670472db434e484c35a5d60c226fb4eecec807e116c9dd5370fb86af6c960e835eda98e8e1d182f5ad6f7d08b933d6fe

  • SSDEEP

    3072:Jds7xEm5K7oIzKlkcw+gF48UJpOVnjwZO7:Ts7lG+kdLF4DJpAnjt

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\eebd0f2ab7ef40775dea11dbfa57c1b4c671b700a9b89175fe5b11b0c0a27f59.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2436
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\eebd0f2ab7ef40775dea11dbfa57c1b4c671b700a9b89175fe5b11b0c0a27f59.dll,#1
      2⤵
        PID:2524
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2524 -s 660
          3⤵
          • Program crash
          PID:4880
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 2524 -ip 2524
      1⤵
        PID:4924

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads