0b8bafc93286ba29bc30bb354e6e9e4b798c6db937c85600e74a0719c91cc01d | Triage

Analysis

max time kernel
140s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2023 11:58

Sharing

Report Analysis Logs

General

Target

log.dll
Size

101KB
MD5

692daae9f0c65d3ddeb593ea6b2775d7
SHA1

9571116d9485ae4e923488ab21b91edff519be57
SHA256

cd6f21535118ab0b675df29f2c67a87cefb6e80e9073636f1cc0b86e45c14891
SHA512

46f5b38a5a6baebbad83e9b8019b5780623e4d6c2aab98359bfc4189dbb386020163355a428680327bfc25bf2a829e8303aafc444ff4e427c9683f65547e595e
SSDEEP

1536:oJjz0l+y4niRTvRWQd2nEdY+pqhpP9GkmDWR/inKQZVhg+bsKv:Rsy4EUbi7DO9eVhg+b1

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4364	3092	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 3092	4848	rundll32.exe	84
PID 4848 wrote to memory of 3092	4848	rundll32.exe	84
PID 4848 wrote to memory of 3092	4848	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\log.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\log.dll,#1
  2⤵
  PID:3092
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3092 -s 568
    3⤵
    - Program crash
    PID:4364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3092 -ip 3092
1⤵
PID:932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads