d6c4395f0ae44000bacfd6e32934f039172d50b88f800e91632aa28224e49062 | Triage

Analysis

max time kernel
101s
max time network
200s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2023, 23:25

Sharing

Report Analysis Logs

General

Target

Module.dll
Size

5.6MB
MD5

456512be55e64adc06604a8ca754a4c1
SHA1

91f6ca205bec76561b34be0f8bc53882d3bac847
SHA256

906f70118cf49eb59f01981ece40b9669ee37d934482c982ae887fa0b5bbea5b
SHA512

e322c0c3a3ea5ff4d0e15458680771130b397bea9b132656710eaed706ce29fa923ff752ef5c05433fb047a356d106bbc518958d86c4be00b09db93924be819a
SSDEEP

98304:TS6C/Lx97QIj+5B2EyYkvR8/lgQ/6SRJ9vN:TaLvnvvGnF

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2868	1528	WerFault.exe	87

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1528	rundll32.exe
1528	rundll32.exe
1528	rundll32.exe
1528	rundll32.exe
1528	rundll32.exe
1528	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 1528	4804	rundll32.exe	87
PID 4804 wrote to memory of 1528	4804	rundll32.exe	87
PID 4804 wrote to memory of 1528	4804	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Module.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Module.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1528
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 684
    3⤵
    - Program crash
    PID:2868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1528 -ip 1528
1⤵
PID:1160

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1528-0-0x0000000001330000-0x0000000001331000-memory.dmp

Filesize
4KB

Download