ba942915005d99a9ed5d3f4bd57f14fd316a6c4b12fa8ddebfa607717722d1bf | Triage

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 16:28

Sharing

Report Analysis Logs

General

Target

5fcfd8d57a4d6672d82d910213b6628b.dll
Size

1.2MB
MD5

5fcfd8d57a4d6672d82d910213b6628b
SHA1

dff4a04e06a0242d81a36c2a61fcf6a93feb3e57
SHA256

ba942915005d99a9ed5d3f4bd57f14fd316a6c4b12fa8ddebfa607717722d1bf
SHA512

851e0ab09a3ab8c19722f29786276f9b909852fd1c85e0d4eb383d37bd721e28b85fd8598d9f4e085774e06931d7f1249457f90d68d25315324433235aa45b92
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQAj1ftxmbfYQJZKpPs:7I99DEWVtQAjZmn0J

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 1000	2204	rundll32.exe	27
PID 2204 wrote to memory of 1000	2204	rundll32.exe	27
PID 2204 wrote to memory of 1000	2204	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5fcfd8d57a4d6672d82d910213b6628b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2204 -s 56
  2⤵
  PID:1000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads