acd9fa27b779469770a4c53602c8bbd33607e1624bf6b5dfd605e2211aa9bae4 | Triage

Analysis

max time kernel
233s
max time network
295s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
09-01-2023 21:02

Sharing

Report Analysis Logs

General

Target

firvetourg/reencountering.dll
Size

788KB
MD5

15dd0873cb6bef0c8e89a0319a202c3a
SHA1

6b49af73134d502d35d81cb978075761dc3b71fa
SHA256

180bc8d0f85146d6d16fa8079e38ca5e84756f1e201fc7259464addbaee15ff2
SHA512

3b1e4b176835eeae62e5ed4ac65b97e26b4471fba4aa0514c969fac8184fdcecaa82e7c9d286d9bec909bf72cce0c6cce6bfa6ec1a2adadb463a0584d6b8d200
SSDEEP

12288:EtsF8uXf3ER0+FFzy9SUa5Eorp//XyZXygB:l8qUR0+FFzvea//XywgB

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2592 900 WerFault.exe rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\firvetourg\reencountering.dll,#1
1⤵
PID:900

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 900 -s 340
2⤵
- Program crash
PID:2592

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 428 -p 900 -ip 900
1⤵
PID:1108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...