1d59b62092422db48a95109b96badc464461d6c0ebdc98cdf00741b4e5cf4de3 | Triage

Analysis

max time kernel
184s
max time network
212s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 14:03

Sharing

Report Analysis Logs

General

Target

sandalwood/forthcoming.dll
Size

599KB
MD5

80a27842055378bd905a43aca1907425
SHA1

a2cde02adff4b083ec91707c24bd0503c5b62985
SHA256

c22fee368833ff4303e6b563fe540c7759f2f4ff0102f3cb8867b30d1be5dda4
SHA512

26f211fab8fdfc1606a668497e8f8d3105fcb5f3ef6755b98f0702ce6dfce355d248a65b8c4eecdfbade2db789212295fb0067ac21b6608950f8b28665c47831
SSDEEP

12288:8PZPmBHmmHD/cJminEGEY7+wO/49T3/lSAH:uPmHRHr/0xH

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1520 4288 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1496 wrote to memory of 4288	1496	rundll32.exe	rundll32.exe
PID 1496 wrote to memory of 4288	1496	rundll32.exe	rundll32.exe
PID 1496 wrote to memory of 4288	1496	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\sandalwood\forthcoming.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1496

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\sandalwood\forthcoming.dll,#1
2⤵
PID:4288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4288 -s 604
3⤵
- Program crash
PID:1520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4288 -ip 4288
1⤵
PID:736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4288-132-0x0000000000000000-mapping.dmp

Download