4cbfa2bd0947022b000616c3aa9b4962c87a9d3b7aceae14f22a94ff756f4d6d | Triage

Analysis

max time kernel
151s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
18/05/2023, 13:41

Sharing

Report Analysis Logs

General

Target

1337.dll
Size

1014KB
MD5

e0d7910c702f92d01c71e52820521bca
SHA1

4e116178d0d997f70a62574eae8d27c30f0a1c20
SHA256

4cbfa2bd0947022b000616c3aa9b4962c87a9d3b7aceae14f22a94ff756f4d6d
SHA512

90fc6e0881ee6afb2033dfd5e0524c6385627a52f07a200b66dfb41eef124e61d866e4385c20748ca9047df3f7ac3778c5116ac1c2fc69da277c57456543a71b
SSDEEP

12288:UjYxnjXcBIlezoQy41hY1eOuQxb64XpyUJM64eMr4JlMxx8Q484xvVAc+IFJNp:UUpcBSf4IeOlbrooi4JluqMQd

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4520	4372	WerFault.exe	24

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 4372	1912	rundll32.exe	24
PID 1912 wrote to memory of 4372	1912	rundll32.exe	24
PID 1912 wrote to memory of 4372	1912	rundll32.exe	24

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1337.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1337.dll,#1
  2⤵
  PID:4372
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4372 -s 596
    3⤵
    - Program crash
    PID:4520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4372 -ip 4372
1⤵
PID:2820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads