40de45ea45d352703a19c4a5b07013c5e748d831e9f67111a776566463c0fbd3 | Triage

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
11-08-2023 18:34

Sharing

Report Analysis Logs

General

Target

Iisbgfhaciadc3_browsingDll.dll
Size

183KB
MD5

4ee3fb2aba3b82171e6409e253bdddb5
SHA1

f5112f83885f2ede5d648224f18d78c5e70b9493
SHA256

40de45ea45d352703a19c4a5b07013c5e748d831e9f67111a776566463c0fbd3
SHA512

9a1c134c906eb85b6802edba37074cae7b5057d15f368937c075920b001ed1491004c1b021ba0bdf8e01d13398d96ae68f5b9968d4a7bc2614d9b83a758ac6e4
SSDEEP

3072:P9031LWaYenq+cAljU4edllrXsYsT4iK9JG1yy59thOpQc:161LOenq+cSoJXCThK12

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2576	2400	WerFault.exe	22

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 2576	2400	rundll32.exe	28
PID 2400 wrote to memory of 2576	2400	rundll32.exe	28
PID 2400 wrote to memory of 2576	2400	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Iisbgfhaciadc3_browsingDll.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2400 -s 84
  2⤵
  - Program crash
  PID:2576

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads