00c677f00271c62b827d1164620fde0d9a7ff7c60dec020a7bf476fa8f40e228 | Triage

Analysis

max time kernel
240s
max time network
281s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13-10-2023 13:11

Sharing

Report Analysis Logs

General

Target

seeex/896.dd.0387b000_6e00.dll
Size

27KB
MD5

43b6e5070b289ccb87dfb5b65f133195
SHA1

69862646d12760b04b5f967d603cf35ad590861e
SHA256

0560063e165a927dc2e1812e71334693a74790d689c20bcf1c687b57d146c48e
SHA512

512b599005f8f9755c5d185a688d46a3dc2f15b527a9c1c347c92b225437898e85f85ed1330affba10197f3df4017a3dbdc2f0485df68469f243978fefd83306
SSDEEP

384:+wXNLyAn8pOmMBmvfj70Fx3049yisuipwKCYDpwAz:PFnKM8vfv0L0isLwKCA

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2656 wrote to memory of 2764	2656	rundll32.exe	WerFault.exe
PID 2656 wrote to memory of 2764	2656	rundll32.exe	WerFault.exe
PID 2656 wrote to memory of 2764	2656	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\seeex\896.dd.0387b000_6e00.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2656

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2656 -s 56
2⤵
PID:2764

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...