527fbfad3a7393d22732e5a3f845939fd576cd09e958b97b84368dcf6020bf29 | Triage

Analysis

max time kernel
10s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
08-12-2022 09:54

Sharing

Report Analysis Logs

General

Target

startles/racially.dll
Size

209KB
MD5

9f6d522e1351f27caa9f79bc6782d197
SHA1

3d41e5d1d10b68ca2b6bfc0ba2e112433caa539e
SHA256

56fc9355e731581623fbfcb507be348e51c65f6afb2ac6e6f44764f7e2693cec
SHA512

6cbb8e603c5c26df5dfd032e2c1c3e784b3fd5fb79628980e41ae798ef78546f857932674b86f6e1bd0461927f46af3accd3a0fb817c033c049e3141ce8489ae
SSDEEP

6144:a7N2DFx/kYWK4XDfAW22//+777777Lw9oHMAqLTJF3u8:a5O//3777777LwmqL9F3u8

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2004 1692 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1692 wrote to memory of 2004	1692	rundll32.exe	WerFault.exe
PID 1692 wrote to memory of 2004	1692	rundll32.exe	WerFault.exe
PID 1692 wrote to memory of 2004	1692	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\startles\racially.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1692

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1692 -s 84
2⤵
- Program crash
PID:2004

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2004-54-0x0000000000000000-mapping.dmp

Download