8ee6e0d63b89d920dc627fca1af5f19653d51e8318adb064cc4f122576e780ce | Triage

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
19/11/2023, 11:26

Sharing

Report Analysis Logs

General

Target

83.dll
Size

854KB
MD5

8df5d7efc2d9092102e2a92e097a33be
SHA1

cc9801f6bd7e818b86fe4fb52752eadbdd859a7d
SHA256

8ee6e0d63b89d920dc627fca1af5f19653d51e8318adb064cc4f122576e780ce
SHA512

ee65444dcd37dff045826dc922dcc97ccd44d7ddfe373bcd971ce0facf91e13f3df07a1368fd6c49e63e8c5c19fc2fd669182f688e80d83804c534dd9d10f1da
SSDEEP

12288:0PcsZ/i18O9zheQQZ7bjnfjaimmVBmJUAI0/bf1IohuX6G6:0PcL19F0QCn5VBKQmS9

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 332	2392	rundll32.exe	28
PID 2392 wrote to memory of 332	2392	rundll32.exe	28
PID 2392 wrote to memory of 332	2392	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\83.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2392 -s 92
  2⤵
  PID:332

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads