10109e69d1fb2fe8f801c3588f829e020f1f29c4638fad5394c1033bc298fd3f | Triage

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
11/06/2023, 11:24

Sharing

Report Analysis Logs

General

Target

xmlprov.dll
Size

2.6MB
MD5

b693e3d2f2cab550ad4f8c5722776498
SHA1

6dc93db10d46cf777f9928803157dd16dc097e79
SHA256

f702dfddbc5b4f1d5a5a9db0a2c013900d30515e69a09420a7c3f6eaac901b12
SHA512

d5c02150265ab6d5d2d6a6e39514b345f6108afaecfd0d8e196b0b99d6d1af36245eb12e8a6879f16b619ba89f8eec442c394eff5f6298d1534c9f0084d63f18
SSDEEP

49152:xL+qLntVtOg3gJjW4UeJiGew5o/ylRbUlo60bNBUDXVFhIECIpuXo+kY8ss:tHnsg3gZHUeANwl6SuF+SFss

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1700	1592	WerFault.exe	22

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1592 wrote to memory of 1700	1592	rundll32.exe	28
PID 1592 wrote to memory of 1700	1592	rundll32.exe	28
PID 1592 wrote to memory of 1700	1592	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\xmlprov.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1592
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1592 -s 92
  2⤵
  - Program crash
  PID:1700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads