a5a4dacddfc07ec9051fb7914a19f65c58aad44bbd3740d7b2b995262bd0c09e | Triage

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
07-06-2023 02:45

Sharing

Report Analysis Logs

General

Target

bb1ec23abf422c5d26f4979c21dc08ef.dll
Size

139KB
MD5

bb1ec23abf422c5d26f4979c21dc08ef
SHA1

a3421cc7c7b19a5fa79ac9967a2a5afb7aa8f6c0
SHA256

a5a4dacddfc07ec9051fb7914a19f65c58aad44bbd3740d7b2b995262bd0c09e
SHA512

e95fff2a339e39de7d24e303fd0ceea36298b0cfa5549e36fcf45b77f60128468cbe5984c825b9d82a4defa0519b5eec9441995149e8e0e4b16226f3ed90aaf0
SSDEEP

3072:tCG+xafWEgyJJZPLxn/yTZNaBP/Q+jUlMSXCb:MGKd9kJJNKt4BPl

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
912	1288	WerFault.exe	17

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 912	1288	rundll32.exe	28
PID 1288 wrote to memory of 912	1288	rundll32.exe	28
PID 1288 wrote to memory of 912	1288	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb1ec23abf422c5d26f4979c21dc08ef.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1288 -s 116
  2⤵
  - Program crash
  PID:912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads