d801739cd759094dc7d1608191364ab38f7a1b5701f92a5a4ba76bd07631e302

Analysis

max time kernel
125s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2023 09:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d801739cd759094dc7d1608191364ab38f7a1b5701f92a5a4ba76bd07631e302.dll
Size

12.4MB
MD5

e14b7bba51655807d120573f1b949d60
SHA1

b41aea48890074a803ccf3030b8cc7a7b49cd102
SHA256

d801739cd759094dc7d1608191364ab38f7a1b5701f92a5a4ba76bd07631e302
SHA512

191cb76b1ce71dbc557a5d875bc7c7fb1798fa3bc3ef518ca69012d5de3f701f70b6368336f80b6c677e3ffbecf51f3dad3e9c0f8e4e257f3b63301cc67cb840
SSDEEP

393216:y4tl8trrkO8JCaL/ABxFFI7KXn3x/84r9:2SCa4UK3pp

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4020	3596	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 3596	1656	rundll32.exe	87
PID 1656 wrote to memory of 3596	1656	rundll32.exe	87
PID 1656 wrote to memory of 3596	1656	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d801739cd759094dc7d1608191364ab38f7a1b5701f92a5a4ba76bd07631e302.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d801739cd759094dc7d1608191364ab38f7a1b5701f92a5a4ba76bd07631e302.dll,#1
  2⤵
  PID:3596
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 656
    3⤵
    - Program crash
    PID:4020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 180 -p 3596 -ip 3596
1⤵
PID:3080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3596-1-0x0000000010000000-0x0000000011A40000-memory.dmp

Filesize
26.2MB

Download
memory/3596-0-0x0000000010000000-0x0000000011A40000-memory.dmp

Filesize
26.2MB

Download
memory/3596-3-0x0000000010000000-0x0000000011A40000-memory.dmp

Filesize
26.2MB

Download
memory/3596-7-0x0000000010000000-0x0000000011A40000-memory.dmp

Filesize
26.2MB

Download
memory/3596-11-0x0000000010000000-0x0000000011A40000-memory.dmp

Filesize
26.2MB

Download
memory/3596-15-0x0000000010000000-0x0000000011A40000-memory.dmp

Filesize
26.2MB

Download
memory/3596-19-0x0000000010000000-0x0000000011A40000-memory.dmp

Filesize
26.2MB

Download
memory/3596-22-0x0000000010000000-0x0000000011A40000-memory.dmp

Filesize
26.2MB

Download
memory/3596-23-0x0000000010000000-0x0000000011A40000-memory.dmp

Filesize
26.2MB

Download
memory/3596-24-0x0000000010000000-0x0000000011A40000-memory.dmp

Filesize
26.2MB

Download
memory/3596-25-0x0000000002130000-0x0000000002E70000-memory.dmp

Filesize
13.2MB

Download
memory/3596-30-0x0000000077232000-0x0000000077233000-memory.dmp

Filesize
4KB

Download
memory/3596-31-0x0000000000550000-0x0000000000551000-memory.dmp

Filesize
4KB

Download
memory/3596-38-0x0000000002130000-0x0000000002E70000-memory.dmp

Filesize
13.2MB

Download
memory/3596-40-0x0000000002130000-0x0000000002E70000-memory.dmp

Filesize
13.2MB

Download
memory/3596-41-0x0000000010000000-0x0000000011A40000-memory.dmp

Filesize
26.2MB

Download
memory/3596-42-0x00000000006B0000-0x00000000006B1000-memory.dmp

Filesize
4KB

Download
memory/3596-43-0x0000000010000000-0x0000000011A40000-memory.dmp

Filesize
26.2MB

Download
memory/3596-44-0x0000000002130000-0x0000000002E70000-memory.dmp

Filesize
13.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads