f2f66d038be816b0fdcf0c4dcb3b1ae792f0d7b6fab17d1ac41c32776dff086e | Triage

Analysis

max time kernel
1757s
max time network
1231s
platform
windows10-2004_x64
resource
win10v2004-20221111-es
resource tags

arch:x64arch:x86image:win10v2004-20221111-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
15/02/2023, 04:45

Sharing

Report Analysis Logs

General

Target

lua5.1.dll
Size

318KB
MD5

feef4703e27d5f36517dcd1d4fd7d2b4
SHA1

25962c4f6523b27394133682b9ebb4b3e3e8bb6d
SHA256

2f54d57bcfa726de8a37942cb3d166a1a171f5dc555cc30e7e6f62ac66f85076
SHA512

160729b3f79b46198b88dbee511edd6378f1ed4e081a245b0596d9b9d8b610288ea9791d49bd6e2de2bc262f1c1e3c987fdabf18b7e2a025fa1808d319719501
SSDEEP

6144:0kn2LG5bwf92+0HiDhAqUS0aMkvAvBtAOj+JzOgVKa:Z2x2cdUhZuIBt8xga

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
824	3360	WerFault.exe	78

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4452 wrote to memory of 3360	4452	rundll32.exe	78
PID 4452 wrote to memory of 3360	4452	rundll32.exe	78
PID 4452 wrote to memory of 3360	4452	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\lua5.1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4452
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\lua5.1.dll,#1
  2⤵
  PID:3360
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3360 -s 608
    3⤵
    - Program crash
    PID:824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3360 -ip 3360
1⤵
PID:4188

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads