088c7d79d16c7d28686b65dff3aadae96dc71ebb47a0418b95dee58d2e4b76a7 | Triage

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
12-12-2022 17:27

Sharing

Report Analysis Logs

General

Target

strona_16.dll
Size

1.2MB
MD5

97c712e90d567ef9f80a1d03ae69f07e
SHA1

c021b0d679e0a0597e748b5438dd15a13c190699
SHA256

c1b30ac4731197caf0ee49c76a9df568d53b630423f8a667417cad42b18d576b
SHA512

e37f16f5a97c6682b12b3ee5a71fbfce30eb8362610b4cd34c9e79c11ded4359a7ffedb7b6bcbdc505d62d452466d58f05a060d692a33586fbcb581183b3d5d5
SSDEEP

24576:b/ZQJy4jzcWnyHvjqtd/g+UaAurHP2ITTTcK:b/qJy4EPO/KjW

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1036	1064	WerFault.exe	26

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 1036	1064	rundll32.exe	27
PID 1064 wrote to memory of 1036	1064	rundll32.exe	27
PID 1064 wrote to memory of 1036	1064	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\strona_16.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1064 -s 84
  2⤵
  - Program crash
  PID:1036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads