12d5db621bcd8ace97296834a9526fb6a4cfc50cc8b40584fd247d5f3c277eb1 | Triage

Analysis

max time kernel
91s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2022 09:24

Sharing

Report Analysis Logs

General

Target

calc.dll
Size

204KB
MD5

9590936149f3ad655e6c6e6e40ffd309
SHA1

580c1ca3d1d22bfe3ebbf47de4e82465217f3230
SHA256

39c19171dd55fa81f755f1aa3e431999ece285f50af34331e651a25952e2906e
SHA512

b1eaf581df67fbac53fc0f1b2061737a15470b415c8e2d429405704a3b60d27cad41ca84020e7a40d43e21760aad542e1db431b7cd9c499c5b1bbb1bc1db314b
SSDEEP

3072:5dFna2JSkcrnYSdM50RAXSPy0qUiS0Lxh5H4evyzUhjQUc5Gy:FRYkcrY4MCIt07iPlvU0jy

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1584 2128 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 5028 wrote to memory of 2128	5028	rundll32.exe	rundll32.exe
PID 5028 wrote to memory of 2128	5028	rundll32.exe	rundll32.exe
PID 5028 wrote to memory of 2128	5028	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\calc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5028

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\calc.dll,#1
2⤵
PID:2128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 636
3⤵
- Program crash
PID:1584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2128 -ip 2128
1⤵
PID:4648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2128-135-0x0000000000000000-mapping.dmp

Download