fe07bb79c5f2bbb2043c0887db7662b15b4ca20fe20f6e951242cc63868177da | Triage

Resubmissions

19/09/2023, 21:23

230919-z8h3hscb2v 7

19/09/2023, 21:22

230919-z71wyaeb42 7

Analysis

max time kernel
126s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2023, 21:22

Sharing

Report Analysis Logs

General

Target

Rc7 - Copy/Rc7/RC7.dll
Size

29KB
MD5

4fb0434430acda70d5f7bc26e0bf7e23
SHA1

32b40693bf32c0c7f2663e77974e501a4cd69b16
SHA256

c6f53a691aa884f37eca99426f6d4a7155851590fab968fb7da27e8da51c385b
SHA512

a7cc5d459b27f6d12154ecc8b36d0dc61636ce6d3e13cf3ab7de013f55f1e8622c00ee8853a4b06151aada3efa8fa1ee94e16a6219b003ffd6be19f5c525bf71
SSDEEP

384:mzJ1xy9pZGPTF34/fuJC56dCaIQF0qJ6I6leuTxB/cwdcTNTCZt6T:cQvfyalQLUhUyBU/RCf6T

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2728	1608	WerFault.exe	64

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4224 wrote to memory of 1608	4224	rundll32.exe	64
PID 4224 wrote to memory of 1608	4224	rundll32.exe	64
PID 4224 wrote to memory of 1608	4224	rundll32.exe	64

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Rc7 - Copy\Rc7\RC7.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4224
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Rc7 - Copy\Rc7\RC7.dll",#1
  2⤵
  PID:1608
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1608 -s 576
    3⤵
    - Program crash
    PID:2728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1608 -ip 1608
1⤵
PID:4152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads