b081802bdff2f3e071a578f650b1d1e94b7f9840fb0a3b35cc1977ea01844164 | Triage

Analysis

max time kernel
121s
max time network
142s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11/10/2023, 13:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ucrtbased.dll
Size

1.7MB
MD5

c3130cfb00549a5a92da60e7f79f5fc9
SHA1

56c2e8fb1af609525b0f732bb67b806bddab3752
SHA256

eee42eabc546e5aa760f8df7105fcf505abffcb9ec4bf54398436303e407a3f8
SHA512

29bab5b441484bdfac9ec21cd4f0f7454af05bfd7d77f7d4662aeaeaa0d3e25439d52aa341958e7896701546b4a607d3c7a32715386c78b746dfae8529a70748
SSDEEP

24576:JUV0C8E3W4JoceLErS6P0qoc6uoPrT5PgVBHmaw+zrGOzli7Gi0m9ZRXyYk:i8/B90ozghlGJ7js

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2012	2212	rundll32.exe	28
PID 2212 wrote to memory of 2012	2212	rundll32.exe	28
PID 2212 wrote to memory of 2012	2212	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ucrtbased.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2212 -s 84
  2⤵
  PID:2012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads