cc4843512076608573c285a95e03361732dab93ae78fba41daba40711ceb9a0c | Triage

Analysis

max time kernel
135s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
06-06-2023 05:53

Sharing

Report Analysis Logs

General

Target

rnthgfcoj.dll
Size

82KB
MD5

5f691d38b05f393f4ff97567762c27a7
SHA1

d713e31e3f4c3543971acfd67d061b06a8ac9560
SHA256

cc4843512076608573c285a95e03361732dab93ae78fba41daba40711ceb9a0c
SHA512

26a5ac9d318de6279977eeebcab4de3e13aedee0a70d7293c9d9efd79ad8afb9c224fedc254115fb52a2df209ea747bb19caf601393b907e52d92c55fba37fb6
SSDEEP

1536:XJ7izBfD5d/bj22eermtUBl3eGF9NFvjEssW5cdxpcTVxD/v0DBS:XItR/1eV2Bl3FpL6xpcTz0

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2956	3404	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4528 wrote to memory of 3404	4528	rundll32.exe	82
PID 4528 wrote to memory of 3404	4528	rundll32.exe	82
PID 4528 wrote to memory of 3404	4528	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\rnthgfcoj.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\rnthgfcoj.dll,#1
  2⤵
  PID:3404
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 716
    3⤵
    - Program crash
    PID:2956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3404 -ip 3404
1⤵
PID:4632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads