a5fc814ab0a22c9684cb7587ffed6a7188e0a061ef4a268b4997e38a5f86aabd | Triage

Resubmissions

14-02-2023 11:56

230214-n4ad2ace4y 10

09-02-2023 19:59

230209-yqlv1sah97 3

Analysis

max time kernel
131s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
09-02-2023 19:59

Sharing

Report Analysis Logs

General

Target

suspicious.dll
Size

1.7MB
MD5

ace1226b3f17cf0cb6e6c3ceae7b95d8
SHA1

369ca9e31a31709641c2491bb895d55b20d5c90c
SHA256

a5fc814ab0a22c9684cb7587ffed6a7188e0a061ef4a268b4997e38a5f86aabd
SHA512

dba25ddeffe58e9258ce39aa3bd1509b6ce115fb6f097992fcce97134f8c7a212dfe5a4061c5c5fadaeba131b3336ccdb3cd79aa01dc53b4f063f6ebd7212540
SSDEEP

24576:nrj3nPW3ednWPiT8VTBqcATV8KIyydLXGcq8z+0uaEYmgE7v99de7:f3nCeCiT8aHxyM18z+XatEh9de

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4832 4768 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2220 wrote to memory of 4768	2220	rundll32.exe	rundll32.exe
PID 2220 wrote to memory of 4768	2220	rundll32.exe	rundll32.exe
PID 2220 wrote to memory of 4768	2220	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\suspicious.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\suspicious.dll,#1
  2⤵
  PID:4768
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 600
    3⤵
    - Program crash
    PID:4832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4768 -ip 4768
1⤵
PID:400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4768-132-0x0000000000000000-mapping.dmp

Download