4bc3f4731059b4f4c05f875a1724a4b2f3824a6b35349b2e9088cbd6d93a70f0 | Triage

Analysis

max time kernel
45s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
31/01/2023, 15:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

300123.dll
Size

722KB
MD5

9207b7ad22298c07557047dbc9631c59
SHA1

376e98e1b5f39581317bcbf23f0b9886ae562f09
SHA256

4bc3f4731059b4f4c05f875a1724a4b2f3824a6b35349b2e9088cbd6d93a70f0
SHA512

22678a1a2758879fd437fd4afc58ad363a6d79bf9a3789aa47ad51300e62195b77550d39329a7540cfd696ac57840a4bcedcbf50dee94128469ec68b302dbc68
SSDEEP

12288:9qwFxm3G6H4RyuHbR1MxnuTV/iV1SdURA8s2Q5Qp:QwFxm3G6H4IuHbR1MxnuTV/iV1QTQ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
788	2020	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 872 wrote to memory of 2020	872	rundll32.exe	28
PID 872 wrote to memory of 2020	872	rundll32.exe	28
PID 872 wrote to memory of 2020	872	rundll32.exe	28
PID 872 wrote to memory of 2020	872	rundll32.exe	28
PID 872 wrote to memory of 2020	872	rundll32.exe	28
PID 872 wrote to memory of 2020	872	rundll32.exe	28
PID 872 wrote to memory of 2020	872	rundll32.exe	28
PID 2020 wrote to memory of 788	2020	rundll32.exe	29
PID 2020 wrote to memory of 788	2020	rundll32.exe	29
PID 2020 wrote to memory of 788	2020	rundll32.exe	29
PID 2020 wrote to memory of 788	2020	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\300123.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:872
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\300123.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2020
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 228
    3⤵
    - Program crash
    PID:788

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2020-55-0x0000000076181000-0x0000000076183000-memory.dmp

Filesize
8KB

Download