361fb5ed35b901790a30f51bc7d1898069c2acd2f374be0d151ba61d9f50967e | Triage

Analysis

max time kernel
142s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
30/08/2023, 14:21

Sharing

Report Analysis Logs

General

Target

file.dll
Size

279KB
MD5

aa1188eb63e988676a78adf858d8a887
SHA1

d56a9093f2a1de794c506c5090161eb06b2fd10b
SHA256

361fb5ed35b901790a30f51bc7d1898069c2acd2f374be0d151ba61d9f50967e
SHA512

b374738c536d139874427e780fc7b1df9381b660079495ac26a68993ab6abe93cd42d1337ebef31627a69199dd8fb27d75433750a1c397c0bcc60c3bb421270a
SSDEEP

3072:TpH5xq5twOiQI9g++sleBLfG/Y+FI4LS4MGhp:TpZGjiDq4LSXGhp

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1144	3116	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 3116	2180	rundll32.exe	81
PID 2180 wrote to memory of 3116	2180	rundll32.exe	81
PID 2180 wrote to memory of 3116	2180	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\file.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\file.dll,#1
  2⤵
  PID:3116
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3116 -s 608
    3⤵
    - Program crash
    PID:1144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3116 -ip 3116
1⤵
PID:3792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads