6c611841f8150bff3266e0421a14b57c28c8767974adbd7e056db54162184934 | Triage

Analysis

max time kernel
132s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
31/08/2023, 20:47

Sharing

Report Analysis Logs

General

Target

tpkproxy2015.dll
Size

184KB
MD5

0b8c7a5db9a1bc12c5a4653b81c52ab0
SHA1

dd265554bdbc715496edc08928b17a30742243b5
SHA256

e8d5d43f6c0f1a25bfbe2eeed05578bff2c469043e198eb027dc87d8fc3ac612
SHA512

26dc58a26dc9843fd48326f932bb101446f5e9dfa3cec7596a66bd917afb1b02a1089b17262fff506bb9faef618d05bbf1d28cb1697e21ee127f595a2583bae0
SSDEEP

3072:6VKg8vVSsFqYGNtLB+UWHy+R3nrC3HPiPTkesSxMxEB+vsoicxD:2KdvVSGqT3oy+dr6H6PT28X+vsPS

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1324	3968	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4396 wrote to memory of 3968	4396	rundll32.exe	82
PID 4396 wrote to memory of 3968	4396	rundll32.exe	82
PID 4396 wrote to memory of 3968	4396	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\tpkproxy2015.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\tpkproxy2015.dll,#1
  2⤵
  PID:3968
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3968 -s 628
    3⤵
    - Program crash
    PID:1324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3968 -ip 3968
1⤵
PID:1300

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads