ce19c1a4e7aa5b2160392a6529452556b8f371c0103f844632397a9f7535dfa8 | Triage

Resubmissions

14/02/2023, 06:53

230214-hnx79sbe26 5

14/02/2023, 06:08

230214-gv83nsaf4y 5

Analysis

max time kernel
1619s
max time network
1624s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
14/02/2023, 06:53

Sharing

Report Analysis Logs

General

Target

WDz.dll
Size

1.7MB
MD5

bbf51226a8670475f283a2d57460d46c
SHA1

6388883ced0ce14ede20c7798338673ff8d6204a
SHA256

73578f14d50f747efa82527a503f1ad542f9db170e2901eddb54d6bce93fc00e
SHA512

f68eb9c4ba0d923082107cff2f0e7f78e80be243b9d92cfab7298f59461fcca2c5c944d4577f161f11a2011c0958a3c32896eba4f0e89cd9f8aed97ab5bc74f9
SSDEEP

24576:fznngr4eig/HxkaoDFITvg9iLXYgIcjWBzb139EOapmYp:fz64gxnoRGI9MXFrjWLNEOapmYp

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1860	1704	WerFault.exe	25

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 1860	1704	rundll32.exe	26
PID 1704 wrote to memory of 1860	1704	rundll32.exe	26
PID 1704 wrote to memory of 1860	1704	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\WDz.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1704 -s 124
  2⤵
  - Program crash
  PID:1860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads