6372927c368b79c065c445ed58617dc9e60975d3fd94b177bd4e10e01694bd2b | Triage

Analysis

max time kernel
132s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2023, 13:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Dullish.dll
Size

829KB
MD5

74ee45a7dc4ca40eaaf817dc5959328d
SHA1

c8bc4d48f0e28dc61d65b4f8e6c0845387e2c44c
SHA256

6372927c368b79c065c445ed58617dc9e60975d3fd94b177bd4e10e01694bd2b
SHA512

685b91f279fcf8b7d2d8ab1865d79146cc0ae47d1a8e3839959b1964ade6e43e7a975ed50b075f463d8fa6aa45ca7f655f1f75f27ca7c6e15a8cf143b4f0e729
SSDEEP

24576:3jfkq3uw3cJg1ZBXJPnSiM/wyRAH5pdlTE:Dkq3nci1Z7/SZwfVE

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1028	3588	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 3588	2556	rundll32.exe	88
PID 2556 wrote to memory of 3588	2556	rundll32.exe	88
PID 2556 wrote to memory of 3588	2556	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dullish.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dullish.dll,#1
  2⤵
  PID:3588
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 648
    3⤵
    - Program crash
    PID:1028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3588 -ip 3588
1⤵
PID:1840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads