1d59b62092422db48a95109b96badc464461d6c0ebdc98cdf00741b4e5cf4de3 | Triage

Analysis

max time kernel
7s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 14:03

Sharing

Report Analysis Logs

General

Target

sandalwood/forthcoming.dll
Size

599KB
MD5

80a27842055378bd905a43aca1907425
SHA1

a2cde02adff4b083ec91707c24bd0503c5b62985
SHA256

c22fee368833ff4303e6b563fe540c7759f2f4ff0102f3cb8867b30d1be5dda4
SHA512

26f211fab8fdfc1606a668497e8f8d3105fcb5f3ef6755b98f0702ce6dfce355d248a65b8c4eecdfbade2db789212295fb0067ac21b6608950f8b28665c47831
SSDEEP

12288:8PZPmBHmmHD/cJminEGEY7+wO/49T3/lSAH:uPmHRHr/0xH

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1356 2028 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1672 wrote to memory of 2028	1672	rundll32.exe	rundll32.exe
PID 1672 wrote to memory of 2028	1672	rundll32.exe	rundll32.exe
PID 1672 wrote to memory of 2028	1672	rundll32.exe	rundll32.exe
PID 1672 wrote to memory of 2028	1672	rundll32.exe	rundll32.exe
PID 1672 wrote to memory of 2028	1672	rundll32.exe	rundll32.exe
PID 1672 wrote to memory of 2028	1672	rundll32.exe	rundll32.exe
PID 1672 wrote to memory of 2028	1672	rundll32.exe	rundll32.exe
PID 2028 wrote to memory of 1356	2028	rundll32.exe	WerFault.exe
PID 2028 wrote to memory of 1356	2028	rundll32.exe	WerFault.exe
PID 2028 wrote to memory of 1356	2028	rundll32.exe	WerFault.exe
PID 2028 wrote to memory of 1356	2028	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\sandalwood\forthcoming.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1672

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\sandalwood\forthcoming.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 224
3⤵
- Program crash
PID:1356

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1356-56-0x0000000000000000-mapping.dmp

Download
memory/2028-54-0x0000000000000000-mapping.dmp

Download
memory/2028-55-0x0000000076AE1000-0x0000000076AE3000-memory.dmp

Filesize
8KB

Download