3c90b3d32f3fe37632edfad2b768cf77d70e7de0d3291d0e5274ea8a7dc69141 | Triage

Analysis

max time kernel
139s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2023, 19:44

Sharing

Report Analysis Logs

General

Target

Slither x32y 64/nw_elf.dll
Size

114KB
MD5

9c18fed3911b120bc6cf07b698ac88fb
SHA1

4a836b85d3105a47aa5bdbe0de0d4732cbd0b774
SHA256

85d78b7f5ffb9d528c361824e2f25fa8e55ee8fbf2bf64140d925d91239fe109
SHA512

5eee334a58cccbb652da9f2459d0e7bc5703b8f9568d0c9a216f78fa86b2908e614ead82eb2b7cde179ca57a60f687624e47293660115079fdc89efbe978e5f4
SSDEEP

3072:RFujVYV9TDv7zdB6ENLkS7+183ijVoSHi:HujKbTDv1hNLkS7v6F

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4084	3888	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 3888	4832	rundll32.exe	80
PID 4832 wrote to memory of 3888	4832	rundll32.exe	80
PID 4832 wrote to memory of 3888	4832	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Slither x32y 64\nw_elf.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Slither x32y 64\nw_elf.dll",#1
  2⤵
  PID:3888
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 616
    3⤵
    - Program crash
    PID:4084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3888 -ip 3888
1⤵
PID:4356

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads