d2f024ad19b8ada353f6459d3ac54529b045d4fadab880fcaa0813f4bfd617bc | Triage

Analysis

max time kernel
95s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
07-04-2023 12:31

Sharing

Report Analysis Logs

General

Target

out.dll
Size

336KB
MD5

43ed6f508ba523e0a3b9224392755ea7
SHA1

8b1e0ec29ab3759d1cec9a01ab4a323e4238684e
SHA256

717118ffe9060081710cd6333549504004c9515df743f696b3c63eb7b2065407
SHA512

cc6b6f112217b466c9c746f7647b833cc62ebe3e0aa2f03439e361fac9964b065c216ada2e4ac19ff5404eb6e663239dbad90b9dee94cd4c173c2667ff522fda
SSDEEP

6144:rICvMnOTvcfgA0qBlJ89Ojo33C1oVDtY4sG2/WctyzuYf0oRCL23/:zvMnAA9BleOjoH4Ktm+jbFL3/

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5104 1700 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3336 wrote to memory of 1700	3336	rundll32.exe	rundll32.exe
PID 3336 wrote to memory of 1700	3336	rundll32.exe	rundll32.exe
PID 3336 wrote to memory of 1700	3336	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\out.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3336

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\out.dll,#1
2⤵
PID:1700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1700 -s 548
3⤵
- Program crash
PID:5104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1700 -ip 1700
1⤵
PID:3888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...