f72cdd9dc87c924b0c843a5bfa14b258346405938c88679a627d26b14ed15847 | Triage

Analysis

max time kernel
151s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
05-05-2023 01:01

Sharing

Report Analysis Logs

General

Target

publish/bin/libdatrie-1.dll
Size

35KB
MD5

8a54723090530190eb11afcd5b702b1b
SHA1

dfa923ec796a754bd21c4f9e504305848a4cb1b2
SHA256

738f67f45faa07cc387baf390604ee4ce709cbe7c223d9a043ee06f7cb360d5b
SHA512

e0d310458c8259112e07b153edc86fdff29e1b09648fed8d163d44deb3bee1545e7ad37bb00e9255df6514844b21a829750848da42f85fa77bef376ce09750cf
SSDEEP

768:Hm5z53y6m/LHlM6GnPGUvMrsztd/sLLhF3VI:a53y6Gy6GuU5d/OhF3G

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1704 1360 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1360 wrote to memory of 1704	1360	rundll32.exe	WerFault.exe
PID 1360 wrote to memory of 1704	1360	rundll32.exe	WerFault.exe
PID 1360 wrote to memory of 1704	1360	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\publish\bin\libdatrie-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1360

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1360 -s 84
2⤵
- Program crash
PID:1704

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1360-54-0x0000000068AC0000-0x0000000068AD1000-memory.dmp

Filesize
68KB

Download