6c8dfbba2dfc6053ef6de63a3eb88e980c4f31fdbd249d30d854314a666fff30 | Triage

Analysis

max time kernel
59s
max time network
66s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2023, 06:14

Sharing

Report Analysis Logs

General

Target

demangler.dll
Size

75KB
MD5

cc74ea40bb1b4eb866f6ee84f6b41a79
SHA1

42023cfd5af17afa02538a5f99141dcda15268e0
SHA256

47d5b5bf9fb06be2fef9f60da10e4b538e4d034937cb98cea143ffbf923c7d02
SHA512

1acc9f478ded50884f2bc9c6b6b5949de3e249696a0b744fecf3322ff306d822469e2e287a629d094735a4123e470b8b1253649a1b9d2dbabac856fc71e2d4d5
SSDEEP

1536:9KoHXYTGjqwOMdjN6A7dzrJBEJszChI5SteqG8Go/fWYyN:9jXYpLMdjAAzB0huStz/fz

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2948	1428	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 1428	2780	rundll32.exe	82
PID 2780 wrote to memory of 1428	2780	rundll32.exe	82
PID 2780 wrote to memory of 1428	2780	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\demangler.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\demangler.dll,#1
  2⤵
  PID:1428
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1428 -s 600
    3⤵
    - Program crash
    PID:2948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1428 -ip 1428
1⤵
PID:1364

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1428-133-0x0000000000770000-0x000000000078C000-memory.dmp

Filesize
112KB

Download
memory/1428-134-0x0000000000770000-0x000000000078C000-memory.dmp

Filesize
112KB

Download