c946192bf47377d97cc4aff9cc4e405acbd19aae30a1745be4b7fa7f230ad8c0 | Triage

Analysis

max time kernel
144s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
05-05-2023 01:21

Sharing

Report Analysis Logs

General

Target

publish/avutil-57.dll
Size

753KB
MD5

a7b21c4bd1a114eff24709d596bcfb20
SHA1

1ec0fa4a1aa105bae5528b74bfe176b4b89791de
SHA256

e46a6821db34a22c0f5a2c7bf43f16cc629c9bcdebfb3a93b4834b0a16815cef
SHA512

7601b79c20367ba777abd7cf075bc7841ba0566b81a83533e543847103524de48de99a9cc1166c2b0759d6dab473515d82faef6efd87024e956a5a74cd32f8c9
SSDEEP

12288:nSdWIND2FdjPMUb2rRE97Z71MJDe332EyFf9w9K29pnaO+iSX:nSdWI82rg9ue33/e4K2O

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1640 1144 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1144 wrote to memory of 1640	1144	rundll32.exe	WerFault.exe
PID 1144 wrote to memory of 1640	1144	rundll32.exe	WerFault.exe
PID 1144 wrote to memory of 1640	1144	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\publish\avutil-57.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1144 -s 100
  2⤵
  - Program crash
  PID:1640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1144-54-0x000007FEF6D00000-0x000007FEF6EDF000-memory.dmp

Filesize
1.9MB

Download