1d0128fd3184a765076397dd308e51bbc578a3639cb9c08ab6b5c36704d772b4

Resubmissions

14-11-2023 17:31

231114-v3qg7acf42 10

14-11-2023 17:21

28-10-2023 19:29

24-10-2023 13:29

18-10-2023 12:04

07-09-2023 12:10

Analysis

max time kernel
435s
max time network
1166s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
18-10-2023 12:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1efeb078625478129da10c0e62b0c842e54286312fbb55c38187bda4d78974bb.dll
Size

44KB
MD5

aedfa7bf1c0e71e0fc136df7a94c0e50
SHA1

b4c51c6f5d161e9cb4752883e49fa1ebebbd6459
SHA256

1efeb078625478129da10c0e62b0c842e54286312fbb55c38187bda4d78974bb
SHA512

72c2f76d73f3e10d0aa761eabed5ad6e1e072991cdb3537719b8833c446a405946cb98cee9858774451d291b1fe00db287830367ff31b0e128bce4b12f8e2684
SSDEEP

768:Iq1MYKFDoccJ7dn8CXvTgyV6J+q6MXCNYKkvPUDrIdwI/CwRoKhG3m+wJoK+:IqeFkcE7dntfTdu+pcSkkD0bqwRTwPwO

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3632	1224	WerFault.exe	49

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 220 wrote to memory of 1224	220	rundll32.exe	49
PID 220 wrote to memory of 1224	220	rundll32.exe	49
PID 220 wrote to memory of 1224	220	rundll32.exe	49

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1efeb078625478129da10c0e62b0c842e54286312fbb55c38187bda4d78974bb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:220
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1efeb078625478129da10c0e62b0c842e54286312fbb55c38187bda4d78974bb.dll,#1
  2⤵
  PID:1224
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1224 -s 688
    3⤵
    - Program crash
    PID:3632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1224 -ip 1224
1⤵
PID:4480

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1224-0-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download
memory/1224-1-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download
memory/1224-2-0x0000000002510000-0x0000000002512000-memory.dmp

Filesize
8KB

Download
memory/1224-3-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download
memory/1224-5-0x0000000002510000-0x0000000002512000-memory.dmp

Filesize
8KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads