f2406ca9821dd1af9404128f5c2964f99bf1480317a398970c3fe46efd596ab0 | Triage

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
13-02-2023 19:00

Sharing

Report Analysis Logs

General

Target

ambien.dll
Size

1.1MB
MD5

7f7905faf89ef42ced1a7197a0236128
SHA1

4be5208f586c2d20a5c5cbf6accf864b99af2eae
SHA256

8691cf5698446dfce18abb87351a7ca46d5ffbbf902a13a035f4be046791d3e7
SHA512

3e579612863aaafe4d315bcdbcfb88a901a073cfc9e0753384e59ef61f104061d26cb913b220b67d312b1e4d9eb9703b562bda62479bfd70d66a1d282a7e18cd
SSDEEP

24576:fwEJQ/rPB8YJqEVm20+MZ26TU5O9L/s1BJSKW9oCxpK+:y/rPm20+MZiAEOoQ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1724	944	WerFault.exe	21

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 944 wrote to memory of 1724	944	rundll32.exe	28
PID 944 wrote to memory of 1724	944	rundll32.exe	28
PID 944 wrote to memory of 1724	944	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ambien.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:944
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 944 -s 84
  2⤵
  - Program crash
  PID:1724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads