55103d365f64281a5ba6b0527687a7be388d0db48705a5eb9ad3ed36a02ffeef | Triage

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2023 11:41

Sharing

Report Analysis Logs

General

Target

2.dll
Size

162KB
MD5

7927301da2b6e6382787ba5e880e195e
SHA1

2f883e13cea6e5db4bf29a57c8b5a2691cc6bddb
SHA256

cb462174c0279d705624005240c733eaf94320cea5b60b495aef0ca7e28d3fe3
SHA512

5bf3065d7ebbb5e8a7b2104d041f057092b9b9b883a9f744b176f5710f9daa54c214baa718ae1d3d5f19b06faea62dc5061401a17b14cedd5d698d8de69cb0ab
SSDEEP

3072:27jswmZp8ZNJ/TjnliUAMnn+L8iNlwC6lbRhvF7:Qjs7ZexTjnlFAc+L8WcN7

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4308	1872	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4936 wrote to memory of 1872	4936	rundll32.exe	85
PID 4936 wrote to memory of 1872	4936	rundll32.exe	85
PID 4936 wrote to memory of 1872	4936	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2.dll,#1
  2⤵
  PID:1872
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 600
    3⤵
    - Program crash
    PID:4308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1872 -ip 1872
1⤵
PID:736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads