fd84fbbb02015979484e56ee1f8de94df66b7c031c8df094c25ee8d4189e2f62 | Triage

Analysis

max time kernel
138s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
15/11/2023, 04:28

Sharing

Report Analysis Logs

General

Target

WCUtil.dll
Size

180KB
MD5

beba3433dad54f893f6e8c5c7bfb024d
SHA1

d3b650571f65b4c021a551f05b3f6e2e645fc192
SHA256

fd84fbbb02015979484e56ee1f8de94df66b7c031c8df094c25ee8d4189e2f62
SHA512

e6fe7e57709dcbd2ba6168758f689ace795276be1fcff884bd476db3aca82e7de4f7d6f6255c608053690015ea96ec97c88f839524f419391788ee6b3176102f
SSDEEP

3072:I74+blpt+wsxMl1NqAc5iSttkClpelrlLMbVaKoXAxOPYe:I74elpowsxizqyStZlpel5AyAxOPF

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4812	5024	WerFault.exe	65

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 5024	2808	rundll32.exe	65
PID 2808 wrote to memory of 5024	2808	rundll32.exe	65
PID 2808 wrote to memory of 5024	2808	rundll32.exe	65

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\WCUtil.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\WCUtil.dll,#1
  2⤵
  PID:5024
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 548
    3⤵
    - Program crash
    PID:4812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5024 -ip 5024
1⤵
PID:404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads