81610cb0050c847dfd3711ee87b929fbd3aaba18cdea3e2d07775ccb9abb04a4 | Triage

Analysis

max time kernel
21s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
12/03/2023, 07:15

Sharing

Report Analysis Logs

General

Target

Clangen/_queue.dll
Size

28KB
MD5

dd146e2fa08302496b15118bf47703cf
SHA1

d06813e2fcb30cbb00bb3893f30c2661686cf4b7
SHA256

67e4e888559ea2c62ff267b58d7a7e95c2ec361703b5aa232aa8b2a1f96a2051
SHA512

5b93a782c9562370fc5b3f289ca422b4d1a1c532e81bd6c95a0063f2e3889ecf828003e42b674439fc7cd0fa72f64ad607bab6910abe9d959a4fb9fb08df263c
SSDEEP

768:UbErqQu06rhuOUrRm4MH5IImUVDG4yaC97hP:wuqXhuOC84a5IImUfydL

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
840	1376	WerFault.exe	13

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 840	1376	rundll32.exe	28
PID 1376 wrote to memory of 840	1376	rundll32.exe	28
PID 1376 wrote to memory of 840	1376	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Clangen\_queue.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1376 -s 108
  2⤵
  - Program crash
  PID:840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads