fe76a64acf9569c5f2370811349618ab0c8d4e3a3c58d6309a9150b2bd2ff34a | Triage

Analysis

max time kernel
91s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
07/02/2023, 21:23

Sharing

Report Analysis Logs

General

Target

01.gif.dll
Size

420KB
MD5

f030dd37f9519b8a1bd20516d03861ea
SHA1

46e3bcc58f6a72587c640872e43d2ce96ad3e84c
SHA256

fe76a64acf9569c5f2370811349618ab0c8d4e3a3c58d6309a9150b2bd2ff34a
SHA512

398bd39950c69592fa81ea2fe022dc837e7d0ef4630ae285b2121d5e481291db0d1b2cbd4f4e3082c884ba634c112c3d958a5da4b7509258ed2a3f3e58bf2e18
SSDEEP

6144:+1bpx1ymed01f3UBRxFoNgKIlp6Ydc2ZiKm5baKrE7eh7PilAFNZzdnLf:sN8d0dkfxFoNgKIlbdc2IOaGlAFnBT

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1648	4960	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 4960	4848	rundll32.exe	80
PID 4848 wrote to memory of 4960	4848	rundll32.exe	80
PID 4848 wrote to memory of 4960	4848	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\01.gif.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\01.gif.dll,#1
  2⤵
  PID:4960
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4960 -s 600
    3⤵
    - Program crash
    PID:1648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4960 -ip 4960
1⤵
PID:4932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads