55103d365f64281a5ba6b0527687a7be388d0db48705a5eb9ad3ed36a02ffeef | Triage

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 11:41

Sharing

Report Analysis Logs

General

Target

2.dll
Size

162KB
MD5

7927301da2b6e6382787ba5e880e195e
SHA1

2f883e13cea6e5db4bf29a57c8b5a2691cc6bddb
SHA256

cb462174c0279d705624005240c733eaf94320cea5b60b495aef0ca7e28d3fe3
SHA512

5bf3065d7ebbb5e8a7b2104d041f057092b9b9b883a9f744b176f5710f9daa54c214baa718ae1d3d5f19b06faea62dc5061401a17b14cedd5d698d8de69cb0ab
SSDEEP

3072:27jswmZp8ZNJ/TjnliUAMnn+L8iNlwC6lbRhvF7:Qjs7ZexTjnlFAc+L8WcN7

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2028	2184	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 2184	2324	rundll32.exe	28
PID 2324 wrote to memory of 2184	2324	rundll32.exe	28
PID 2324 wrote to memory of 2184	2324	rundll32.exe	28
PID 2324 wrote to memory of 2184	2324	rundll32.exe	28
PID 2324 wrote to memory of 2184	2324	rundll32.exe	28
PID 2324 wrote to memory of 2184	2324	rundll32.exe	28
PID 2324 wrote to memory of 2184	2324	rundll32.exe	28
PID 2184 wrote to memory of 2028	2184	rundll32.exe	29
PID 2184 wrote to memory of 2028	2184	rundll32.exe	29
PID 2184 wrote to memory of 2028	2184	rundll32.exe	29
PID 2184 wrote to memory of 2028	2184	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2184
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 224
    3⤵
    - Program crash
    PID:2028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads