f95112e58036037fb220468a09bdb0509dfab937b73bd7d154d3b007e912f8a4 | Triage

Analysis

max time kernel
7s
max time network
2s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
23/08/2023, 19:02

Sharing

Report Analysis Logs

General

Target

0x00090000000230b5-58.dll
Size

1.2MB
MD5

c31eaf60de0ba635a5c0decccff1ab78
SHA1

5aa8c26ee35f26286b56c49ffa24c2e01aa43329
SHA256

f95112e58036037fb220468a09bdb0509dfab937b73bd7d154d3b007e912f8a4
SHA512

23852687f22de78b54efcd7c90ba5d999697a6518dd56ee7e9307077b2517e71833667bce8d669ecd682c7af788b4e5af26e9504b6e27decc6447ae3c79f93fc
SSDEEP

24576:I4KO7C3WfysDqQ0GmAVNkM+oCEIZM+aTp/McfZPtZXJxZ:R72WftmAVNkM+0IZq/TntJxZ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
620	2112	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 620	2112	rundll32.exe	28
PID 2112 wrote to memory of 620	2112	rundll32.exe	28
PID 2112 wrote to memory of 620	2112	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0x00090000000230b5-58.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2112 -s 168
  2⤵
  - Program crash
  PID:620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads