0789c6a858be23e4d89307e5d77c739eb2d638707d0618dcfa5512ebe4d87bf2 | Triage

Analysis

max time kernel
90s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2022, 21:15

Sharing

Report Analysis Logs

General

Target

cursor.dll
Size

1.2MB
MD5

1004ed5ecf1c40722d3b482617034cce
SHA1

fe172eb831be397eed00a422f399f6628c21fc6e
SHA256

0789c6a858be23e4d89307e5d77c739eb2d638707d0618dcfa5512ebe4d87bf2
SHA512

cf15d7d739860b75e027c3718e71fb5bbe13b62680e72fa926d49822acd6525fab32f176d42c1afc3e0378812540500ab8587ba4b960302b6cbfde8d93f29443
SSDEEP

24576:LKbbqQlRH90zhBs7tl+vJtzsJPwfwXR1F0yvc8NTmIg9EcjZdFkz2:LKXqQz901gcDsJPwfwXfFxvFnQN

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2360	3684	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 3684	4400	rundll32.exe	81
PID 4400 wrote to memory of 3684	4400	rundll32.exe	81
PID 4400 wrote to memory of 3684	4400	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cursor.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cursor.dll,#1
  2⤵
  PID:3684
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3684 -s 600
    3⤵
    - Program crash
    PID:2360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3684 -ip 3684
1⤵
PID:3456

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads