5a5154c5843a18d3912063b827ef541a709aec4132b847d75d7e634683acff8d | Triage

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
04/10/2023, 15:55

Sharing

Report Analysis Logs

General

Target

xSa.dll
Size

855KB
MD5

cf46f0cd591e50c425136470505e8a9e
SHA1

0e3d1488b9aa104aa0a39966132a70a47165aaef
SHA256

5a5154c5843a18d3912063b827ef541a709aec4132b847d75d7e634683acff8d
SHA512

3bddf5e233dbd8c4554c73050b0299892b7132afc1bdc67882daa309e0bf1767430aebade35977d06564f41477eeedb5840595cf2446e28d7d47d03179a1a5e4
SSDEEP

24576:v7UuAhS4VYKBOSR45LlxAh/uSLKAlr/A/cYV5fN:6/YVSulxb1AlurF

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2888	1732	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 1732	1764	rundll32.exe	28
PID 1764 wrote to memory of 1732	1764	rundll32.exe	28
PID 1764 wrote to memory of 1732	1764	rundll32.exe	28
PID 1764 wrote to memory of 1732	1764	rundll32.exe	28
PID 1764 wrote to memory of 1732	1764	rundll32.exe	28
PID 1764 wrote to memory of 1732	1764	rundll32.exe	28
PID 1764 wrote to memory of 1732	1764	rundll32.exe	28
PID 1732 wrote to memory of 2888	1732	rundll32.exe	29
PID 1732 wrote to memory of 2888	1732	rundll32.exe	29
PID 1732 wrote to memory of 2888	1732	rundll32.exe	29
PID 1732 wrote to memory of 2888	1732	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\xSa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\xSa.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1732
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 224
    3⤵
    - Program crash
    PID:2888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads