e7e68c5e7d8d244f57455f83148f574094d216a634cb2259880c0910088402a4 | Triage

Analysis

max time kernel
72s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
10-02-2023 21:08

Sharing

Report Analysis Logs

General

Target

features.dll
Size

1.1MB
MD5

0754f0df91f71d2e36f234c3852b157b
SHA1

6af19eb260bae0f01d13e6d618d93d63eb82d7c5
SHA256

c9eb997b9af05af641a3708b006e34e6a9a4e7755fca72205cd187110375e7ac
SHA512

f944a79b5852c7b8280dc479e2d4fd06bb09bbdb566bc5cbb4dc8340477204139ec4b9b0acbee3b7e3a3b2bc73f869f1e1d691690a35c9e9f711ab17e43f9deb
SSDEEP

24576:UxhinDzFYOcJpi16vsYSPN93IlZn3oCwg8LKMYL31IQNV:6iDnYc16vJO9QoC1M2N

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
960	564	WerFault.exe	8

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 564 wrote to memory of 960	564	rundll32.exe	28
PID 564 wrote to memory of 960	564	rundll32.exe	28
PID 564 wrote to memory of 960	564	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\features.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:564
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 564 -s 84
  2⤵
  - Program crash
  PID:960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads