4bc3f4731059b4f4c05f875a1724a4b2f3824a6b35349b2e9088cbd6d93a70f0 | Triage

Analysis

max time kernel
90s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
31-01-2023 15:57

Sharing

Report Analysis Logs

General

Target

300123.dll
Size

722KB
MD5

9207b7ad22298c07557047dbc9631c59
SHA1

376e98e1b5f39581317bcbf23f0b9886ae562f09
SHA256

4bc3f4731059b4f4c05f875a1724a4b2f3824a6b35349b2e9088cbd6d93a70f0
SHA512

22678a1a2758879fd437fd4afc58ad363a6d79bf9a3789aa47ad51300e62195b77550d39329a7540cfd696ac57840a4bcedcbf50dee94128469ec68b302dbc68
SSDEEP

12288:9qwFxm3G6H4RyuHbR1MxnuTV/iV1SdURA8s2Q5Qp:QwFxm3G6H4IuHbR1MxnuTV/iV1QTQ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1312	1724	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4752 wrote to memory of 1724	4752	rundll32.exe	82
PID 4752 wrote to memory of 1724	4752	rundll32.exe	82
PID 4752 wrote to memory of 1724	4752	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\300123.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\300123.dll,#1
  2⤵
  PID:1724
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 600
    3⤵
    - Program crash
    PID:1312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1724 -ip 1724
1⤵
PID:2224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1724-132-0x0000000000000000-mapping.dmp

Download