5517f176fbd908ab99f0afe8980ce9e118cf89ba982dde9d403f47e9c5f4a8b8 | Triage

Analysis

max time kernel
149s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07-12-2022 06:46

Sharing

Report Analysis Logs

General

Target

TE04/syndrome/dicta.dll
Size

596KB
MD5

98b6b7eb3a0d889bdfd24130e72e8afd
SHA1

46be771ff368e840160bd5e03a45ec93d8fbc3ee
SHA256

bf3915a0a3e128b90d5f3c3173c4310e71d458d778d3bb7b9695c18892256120
SHA512

b36b8089b59390e3d39e10cedc28c485c317e4df3d01f669e56e817e1b3fb1fb069417c8e9e0022824fc74208b5bee727ad9441d0c5656f43cd3cc93789f67c2
SSDEEP

12288:4n8J739YoRmwZBY9bk8OlBf07A4QDXSAIdQFFF7:481FR7tVlDXScn

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3148 2976 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 860 wrote to memory of 2976	860	rundll32.exe	rundll32.exe
PID 860 wrote to memory of 2976	860	rundll32.exe	rundll32.exe
PID 860 wrote to memory of 2976	860	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\TE04\syndrome\dicta.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:860

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\TE04\syndrome\dicta.dll,#1
2⤵
PID:2976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2976 -s 608
3⤵
- Program crash
PID:3148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2976 -ip 2976
1⤵
PID:2564

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2976-132-0x0000000000000000-mapping.dmp

Download