08ed32f799e436ae8dcf68e61bcd96fd0e46fbb266eeb7555dc850ad6481f8ef | Triage

Analysis

max time kernel
133s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
04/11/2023, 13:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

DjVuToy.dll
Size

2.0MB
MD5

0a1c10752b6d01917324c87a4947d282
SHA1

d189052ec7f9e1a79c7db18a139f140097c7f0c1
SHA256

0f0ee610b853be82fc13e70d5d9778e2c2480a11268db2f98ccf3025f478ec31
SHA512

9d0aacf1b0afdb0a2db13ea21329e8ec97d76fa4fb27b13a35b8f436d1a8db571d9814018983a1ff1b11c5d414db3b84573c8e39a5206064b69477cc66703956
SSDEEP

49152:2Gxbfz0q4ZuRjNCgCT4YCMpYT+3vuWOjnHDBZ:2+wa9NCg3Gv

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4404	4856	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4392 wrote to memory of 4856	4392	rundll32.exe	88
PID 4392 wrote to memory of 4856	4392	rundll32.exe	88
PID 4392 wrote to memory of 4856	4392	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DjVuToy.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DjVuToy.dll,#1
  2⤵
  PID:4856
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4856 -s 616
    3⤵
    - Program crash
    PID:4404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4856 -ip 4856
1⤵
PID:1904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads