87a90d6da5dd96054ec693e882173db625f4c48de2a7b83e866b1e7a855d2470 | Triage

Analysis

max time kernel
292s
max time network
298s
platform
windows10-2004_x64
resource
win10v2004-20230220-es
resource tags

arch:x64arch:x86image:win10v2004-20230220-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
03/05/2023, 17:25

Sharing

Report Analysis Logs

General

Target

Binary.Paifd.dll
Size

4.5MB
MD5

ab1c0dffb7177a05796d8723937e76ec
SHA1

6f474d2c4a237ba3806b7dd5b683bb6ac23720cd
SHA256

87a90d6da5dd96054ec693e882173db625f4c48de2a7b83e866b1e7a855d2470
SHA512

1fb2a4dbc324977173e72437e5715427290e55a75308437fddabb0f4034761378657e89841fced906067dc77cd2dd1879cb232556cf8e83933b3ab2575edb303
SSDEEP

49152:/bRI9gvBnGynHrSrhbHYZG4YaxcfL1487CRqTiKN/70Wbzax:z69gMZ+hYucfB4/gRF

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4648	1984	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 1984	1656	rundll32.exe	81
PID 1656 wrote to memory of 1984	1656	rundll32.exe	81
PID 1656 wrote to memory of 1984	1656	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Binary.Paifd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Binary.Paifd.dll,#1
  2⤵
  PID:1984
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 684
    3⤵
    - Program crash
    PID:4648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1984 -ip 1984
1⤵
PID:5036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1984-133-0x0000000074800000-0x0000000074C8A000-memory.dmp

Filesize
4.5MB

Download