fe07bb79c5f2bbb2043c0887db7662b15b4ca20fe20f6e951242cc63868177da | Triage

Analysis

max time kernel
138s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 11:40

Sharing

Report Analysis Logs

General

Target

Rc7 - Copy/Rc7/RC7.dll
Size

29KB
MD5

4fb0434430acda70d5f7bc26e0bf7e23
SHA1

32b40693bf32c0c7f2663e77974e501a4cd69b16
SHA256

c6f53a691aa884f37eca99426f6d4a7155851590fab968fb7da27e8da51c385b
SHA512

a7cc5d459b27f6d12154ecc8b36d0dc61636ce6d3e13cf3ab7de013f55f1e8622c00ee8853a4b06151aada3efa8fa1ee94e16a6219b003ffd6be19f5c525bf71
SSDEEP

384:mzJ1xy9pZGPTF34/fuJC56dCaIQF0qJ6I6leuTxB/cwdcTNTCZt6T:cQvfyalQLUhUyBU/RCf6T

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
928	1888	WerFault.exe	21

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 1888	1096	rundll32.exe	21
PID 1096 wrote to memory of 1888	1096	rundll32.exe	21
PID 1096 wrote to memory of 1888	1096	rundll32.exe	21

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Rc7 - Copy\Rc7\RC7.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Rc7 - Copy\Rc7\RC7.dll",#1
  2⤵
  PID:1888
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 568
    3⤵
    - Program crash
    PID:928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1888 -ip 1888
1⤵
PID:976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads