a42dd6bea439b79db90067b84464e755488b784c3ee2e64ef169b9dcdd92b069 | Triage

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 01:04

Sharing

Report Analysis Logs

General

Target

AppvIsvSubsystems64.dll
Size

26KB
MD5

9159d3c58c5d970ed25c2db9c9487d7a
SHA1

6382ae2061c865ddcb9337f155ae2d036e232dfe
SHA256

a42dd6bea439b79db90067b84464e755488b784c3ee2e64ef169b9dcdd92b069
SHA512

4c13887a44338b5e40502ce31c1834e356679e63080858c1fa193ebf4efdce04a9c6bcbb759884832f8c54c4d61781f03ca92a924679d504e896dd6782a4db9b
SSDEEP

768:mT05VdLSCesMfhCKgYNebcQCsDDDDVN0X:9dLvMfhCtYNrQCsDDDDX8

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2348	2112	rundll32.exe	28
PID 2112 wrote to memory of 2348	2112	rundll32.exe	28
PID 2112 wrote to memory of 2348	2112	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AppvIsvSubsystems64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2112 -s 80
  2⤵
  PID:2348

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads