0c79397158fc97d5422d60d42ce07f321803c535eaff888b37f971686dc0f912 | Triage

Analysis

max time kernel
135s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2023, 18:08

Sharing

Report Analysis Logs

General

Target

401_.dll
Size

320KB
MD5

22a8c03fb6e3e12a19ca25fbfb2421ea
SHA1

e6c5479cd482cf88c519d3d9f08511a11f58d531
SHA256

0c79397158fc97d5422d60d42ce07f321803c535eaff888b37f971686dc0f912
SHA512

d8b3b7b1ba007f403699805002cd8b17270b2ed5bbb9598b254a5eb7436f904c997e27a077e9e1ef875f8e0273f140bbe1fffa275a43c7558800f3f362f0be90
SSDEEP

6144:IynKe1U6ybW6cShRZuWYteU/0luNwOGJptI+hLb4LGSKoJ/5LvV:ICjOi6DuRltOEGLELGSXzz

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3584	1420	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 1420	2292	rundll32.exe	83
PID 2292 wrote to memory of 1420	2292	rundll32.exe	83
PID 2292 wrote to memory of 1420	2292	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\401_.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\401_.dll,#1
  2⤵
  PID:1420
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 596
    3⤵
    - Program crash
    PID:3584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1420 -ip 1420
1⤵
PID:1792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads