7011b5995a1753ef8076c92c0d07441742aabee263bbd604f690b64778b85bc7 | Triage

Analysis

max time kernel
222s
max time network
246s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13-10-2023 13:18

Sharing

Report Analysis Logs

General

Target

Image Logger/RTFC.dll
Size

56KB
MD5

7f23187f60ed001523ff19a2c0b71245
SHA1

0984bf5d03f2477b8f9872cb955e58a0ec7c3427
SHA256

febbd8d4849b6411de8ead30414a760dde2e519cb4395b47608e6e49be6cee82
SHA512

3c300c33b64e73ed4228782da544a15c83809338de6dc80aa90d6ad0877826a279e084e730db47f9df90c1780fd1e3bfe6e2f5192da9549e1af30383856ae443
SSDEEP

1536:8dQYuf21toQdCv/7qsJ0uNDboDMO1dM1370:2tuYFy7PJtNvoDMO1w370

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5028 3028 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2324 wrote to memory of 3028	2324	rundll32.exe	rundll32.exe
PID 2324 wrote to memory of 3028	2324	rundll32.exe	rundll32.exe
PID 2324 wrote to memory of 3028	2324	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Image Logger\RTFC.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2324

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Image Logger\RTFC.dll",#1
2⤵
PID:3028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 632
3⤵
- Program crash
PID:5028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3028 -ip 3028
1⤵
PID:5060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...