55103d365f64281a5ba6b0527687a7be388d0db48705a5eb9ad3ed36a02ffeef | Triage

Analysis

max time kernel
140s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
27-09-2023 12:54

Sharing

Report Analysis Logs

General

Target

2.dll
Size

162KB
MD5

7927301da2b6e6382787ba5e880e195e
SHA1

2f883e13cea6e5db4bf29a57c8b5a2691cc6bddb
SHA256

cb462174c0279d705624005240c733eaf94320cea5b60b495aef0ca7e28d3fe3
SHA512

5bf3065d7ebbb5e8a7b2104d041f057092b9b9b883a9f744b176f5710f9daa54c214baa718ae1d3d5f19b06faea62dc5061401a17b14cedd5d698d8de69cb0ab
SSDEEP

3072:27jswmZp8ZNJ/TjnliUAMnn+L8iNlwC6lbRhvF7:Qjs7ZexTjnlFAc+L8WcN7

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4540 4584 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1568 wrote to memory of 4584	1568	rundll32.exe	rundll32.exe
PID 1568 wrote to memory of 4584	1568	rundll32.exe	rundll32.exe
PID 1568 wrote to memory of 4584	1568	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2.dll,#1
  2⤵
  PID:4584
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 600
    3⤵
    - Program crash
    PID:4540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4584 -ip 4584
1⤵
PID:4408

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads