7011b5995a1753ef8076c92c0d07441742aabee263bbd604f690b64778b85bc7 | Triage

Analysis

max time kernel
166s
max time network
273s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13-10-2023 13:18

Sharing

Report Analysis Logs

General

Target

Image Logger/RTUI.dll
Size

363KB
MD5

4f490d1686dd159f2d260a917372dead
SHA1

ed5e88c5d2cfdee84a15afa14a5b2c259f4179e8
SHA256

7ad87cd882d7ce3ad3d28dcb09cb2dddd99825a40467f81dae490d5416c005fc
SHA512

4474839282828baf4abb97936b7bb28e4099af68598e91ccc19fa81ca2e39c0eb598ad090ee173a9e02596b863a9eda9d96393823e015b3900cb6bc8540af022
SSDEEP

6144:b9dlLVWY+Ps3HAgjk5N+qghCvxyyXtdX1IDq7fJTBqCSWOyRSU:bpoU3m9vxd9dX1nTsC

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1400 4888 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1524 wrote to memory of 4888	1524	rundll32.exe	rundll32.exe
PID 1524 wrote to memory of 4888	1524	rundll32.exe	rundll32.exe
PID 1524 wrote to memory of 4888	1524	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Image Logger\RTUI.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1524

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Image Logger\RTUI.dll",#1
2⤵
PID:4888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4888 -s 668
3⤵
- Program crash
PID:1400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4888 -ip 4888
1⤵
PID:4988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4888-0-0x00000000021E0000-0x00000000021F1000-memory.dmp

Filesize
68KB

Download