da3806880e342d4b826b9f58f55c1d75023ff5081c5373af911f21f45fd4b5f8 | Triage

Analysis

max time kernel
143s
max time network
35s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
15/06/2023, 21:13

Sharing

Report Analysis Logs

General

Target

libgcrypt-20.dll
Size

858KB
MD5

ead4a12b1e7148e1778520dd35837f0b
SHA1

1ef86ac645404a82d68cfa8ad94a57bef0218c94
SHA256

799f960ed53f85fb780e35af144b5b63e59f55827f2d5a4a1617bcf5a46a8268
SHA512

391329330285083c0ea4fd5027b7419f506f21ef109179f836d4b2dcafaf83323872ae3efa66c837b9df669a185365aead5a0c56df2f3453a079e15c01b6d8b0
SSDEEP

24576:BtrM/CgG890ld8DZQxw1eytJDyjJdwjvUV:DM6Pzdy7O

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1064	1256	WerFault.exe	26

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 1256	1144	rundll32.exe	26
PID 1144 wrote to memory of 1256	1144	rundll32.exe	26
PID 1144 wrote to memory of 1256	1144	rundll32.exe	26
PID 1144 wrote to memory of 1256	1144	rundll32.exe	26
PID 1144 wrote to memory of 1256	1144	rundll32.exe	26
PID 1144 wrote to memory of 1256	1144	rundll32.exe	26
PID 1144 wrote to memory of 1256	1144	rundll32.exe	26
PID 1256 wrote to memory of 1064	1256	rundll32.exe	27
PID 1256 wrote to memory of 1064	1256	rundll32.exe	27
PID 1256 wrote to memory of 1064	1256	rundll32.exe	27
PID 1256 wrote to memory of 1064	1256	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libgcrypt-20.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libgcrypt-20.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1256
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 228
    3⤵
    - Program crash
    PID:1064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1256-54-0x00000000655C0000-0x000000006569E000-memory.dmp

Filesize
888KB

Download
memory/1256-55-0x000000006B480000-0x000000006B4B8000-memory.dmp

Filesize
224KB

Download