27ceb14c21f83c69b29614cb385b7267efc6e26ff3d96055fb8f5a8e7314e066 | Triage

Analysis

max time kernel
255s
max time network
315s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
08/10/2023, 02:47

Sharing

Report Analysis Logs

General

Target

f71c3942ced5450cbb9447c041d99d8b.dll
Size

1.2MB
MD5

f71c3942ced5450cbb9447c041d99d8b
SHA1

a01ce88cd6d6b0560c82aa5d91f9edd4ecddfc78
SHA256

27ceb14c21f83c69b29614cb385b7267efc6e26ff3d96055fb8f5a8e7314e066
SHA512

56c063ac2fdecc0400fdce1dbafe8b7755da2a336456e0405d7650b8c603a03c33bed10d4795fb73d0d99f4b3ec5e091a955cfb38769b3d67df599d9c3f26f58
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQAT1ftxmbfYQJZKXfV:7I99DEWVtQATZmn0P

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2548	2868	rundll32.exe	27
PID 2868 wrote to memory of 2548	2868	rundll32.exe	27
PID 2868 wrote to memory of 2548	2868	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f71c3942ced5450cbb9447c041d99d8b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2868 -s 56
  2⤵
  PID:2548

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads