0789c6a858be23e4d89307e5d77c739eb2d638707d0618dcfa5512ebe4d87bf2 | Triage

Analysis

max time kernel
27s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
22/12/2022, 21:15

Sharing

Report Analysis Logs

General

Target

cursor.dll
Size

1.2MB
MD5

1004ed5ecf1c40722d3b482617034cce
SHA1

fe172eb831be397eed00a422f399f6628c21fc6e
SHA256

0789c6a858be23e4d89307e5d77c739eb2d638707d0618dcfa5512ebe4d87bf2
SHA512

cf15d7d739860b75e027c3718e71fb5bbe13b62680e72fa926d49822acd6525fab32f176d42c1afc3e0378812540500ab8587ba4b960302b6cbfde8d93f29443
SSDEEP

24576:LKbbqQlRH90zhBs7tl+vJtzsJPwfwXR1F0yvc8NTmIg9EcjZdFkz2:LKXqQz901gcDsJPwfwXfFxvFnQN

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1984	1996	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1996	2020	rundll32.exe	27
PID 2020 wrote to memory of 1996	2020	rundll32.exe	27
PID 2020 wrote to memory of 1996	2020	rundll32.exe	27
PID 2020 wrote to memory of 1996	2020	rundll32.exe	27
PID 2020 wrote to memory of 1996	2020	rundll32.exe	27
PID 2020 wrote to memory of 1996	2020	rundll32.exe	27
PID 2020 wrote to memory of 1996	2020	rundll32.exe	27
PID 1996 wrote to memory of 1984	1996	rundll32.exe	28
PID 1996 wrote to memory of 1984	1996	rundll32.exe	28
PID 1996 wrote to memory of 1984	1996	rundll32.exe	28
PID 1996 wrote to memory of 1984	1996	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cursor.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cursor.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 224
    3⤵
    - Program crash
    PID:1984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1996-55-0x0000000075D61000-0x0000000075D63000-memory.dmp

Filesize
8KB

Download