daa0a2d32134a108ab3af38899d8b6cf4bfc75e3d1d7c3a890a25cedd018afa1 | Triage

Analysis

max time kernel
141s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
24/03/2023, 17:19

Sharing

Report Analysis Logs

General

Target

libgmp-10.dll
Size

497KB
MD5

1b73b0dcc505152ea8923eebb075244d
SHA1

bde642fcd0d6bd4709c45a0735593ed8ef44e0c9
SHA256

daa0a2d32134a108ab3af38899d8b6cf4bfc75e3d1d7c3a890a25cedd018afa1
SHA512

88e7cf532b33f050e9dc0589d8e17e4af46d3de5aa9626ec713281359e06347182bee0bc62fa55f18fdc6cc7953964455d946630cf33749ce0af50939f7fd74a
SSDEEP

12288:ghWlLF45Vn42SEgwNrQi3I0HHFxl6NU7lw8FbEF3l:gmLF4w2SFwNrQiY0H56T8FbEF3l

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1048	2032	WerFault.exe	20

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1048	2032	rundll32.exe	28
PID 2032 wrote to memory of 1048	2032	rundll32.exe	28
PID 2032 wrote to memory of 1048	2032	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libgmp-10.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2032 -s 84
  2⤵
  - Program crash
  PID:1048

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2032-54-0x000000006ACC0000-0x000000006AD45000-memory.dmp

Filesize
532KB

Download