d12c8c6869822b02333d2fb6d064774a3ff9eb9844465da5e56fe337ff0cbaeb | Triage™

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2023, 16:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
loader/3.dll
Size 833KB
Sample230620-tgryfsch75
SHA256 0fb7b6a296ffa9e0f399d14ba0913d419781a28c2b1c93f4b77c2b1f66d6e71b
MD5 d7c4fe09863d32f120b9c9f8482f91e2
SHA1 99bd1ccb34ff47f5299f359349d5733bc0db5b64
SHA512 8ff8a04b9fb251d62d2dfb47ac53c13ed58913a7c61653ce1097ee3c6733bb40d4d8010028193dba346bf2e3d340ac61a22b9f73de3cfb19fed127255226057f
SSDEEP 24576:3C4lIeA97+mgxDkID8c4aykLy6GNZDjf:37iovQatLy
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1332	4336	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 672 wrote to memory of 4336	672	rundll32.exe	83
PID 672 wrote to memory of 4336	672	rundll32.exe	83
PID 672 wrote to memory of 4336	672	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\loader\3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:672
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\loader\3.dll,#1
  2⤵
  PID:4336
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 600
    3⤵
    - Program crash
    PID:1332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4336 -ip 4336
1⤵
PID:1100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4336-133-0x000000006E2C0000-0x000000006E3A3000-memory.dmp

Download