46844cde9676b0289d253d2c109911d4c7fc0f1e7878fae935129dd848ee0f11 | Triage

Analysis

max time kernel
26s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
02-04-2023 13:40

Sharing

Report Analysis Logs

General

Target

baselib.dll
Size

395KB
MD5

cd5f4dfaa645d0be46d08b39efc47195
SHA1

e890a0e4f78ec1cfb6b3cc55d9fc5f7e7e475c7f
SHA256

c9c3dd7473d3f3c94c1058ea627cd1b75e1bb482734658d6d085e1a7c3574edb
SHA512

9f207059ccdecda66055a530ac2abcf0a2f4dc55f016b558ed0a89e111649b613dc03a0306afc75a4b70ae180b643a59a668adcaefe82baca8c1eae476c5d268
SSDEEP

6144:mmLYuq1+dNhJ6d0BNxcHqT4PxAVsyyhcm7vv78sdTW4FYVXpy3XVvfBH3:9Yuamvq+GyYoGdb1d

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1680	1988	WerFault.exe	26

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 1680	1988	rundll32.exe	28
PID 1988 wrote to memory of 1680	1988	rundll32.exe	28
PID 1988 wrote to memory of 1680	1988	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\baselib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1988 -s 84
  2⤵
  - Program crash
  PID:1680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads