6e0a64ae1c914961faa708b0ff5f43c30d3c04997e05bd2add145ffe07debf2a | Triage

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2023 19:26

Sharing

Report Analysis Logs

General

Target

NDAPersonalData/desktop.dll
Size

1.4MB
MD5

0f9d853f54ed0d1a800051ec718f16db
SHA1

a12bd8f8edff0743e92119527673c91d2d0888e0
SHA256

18ff52ee24dbdf6593324b52250115b6c5314e159b681a3a437e3b163d3bf6ab
SHA512

04cdae504c213aa6fa645bd3d2a948dbfa5d616b3516f5787d79f5054ee25c3938e07259e4a3d59c8a7265a4f686897859aeadc419b92adb17b5d3595eb45da2
SSDEEP

24576:mTfaPo9UzJSUrZMrZjY57tj2OM8SC/XPt8JGfZb3GW2:8fKo9uJSUrZgwtc8SC/uJGu

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3132 2472 WerFault.exe rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NDAPersonalData\desktop.dll,#1
1⤵
PID:2472

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2472 -s 404
2⤵
- Program crash
PID:3132

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 440 -p 2472 -ip 2472
1⤵
PID:2260

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...