4389f6fbbb6ecd15f872e419ef8e92bcde8c99e1d6ae98609c4cefb88aba4253 | Triage

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2023 01:13

Sharing

Report Analysis Logs

General

Target

jli.dll
Size

12.4MB
MD5

e06b51fc094ab322ce2245be8349216c
SHA1

2c08c5a87615383289d8a83203dc2ecfdae3e0ab
SHA256

2d22f9065326574ffb475b1cbe2c4a15e9347a3dcb255e0bf1652d9fd9a63374
SHA512

076e5a91c96da1eda1dd30821ecaf63b2a2380b0348d5a04944b8e16678d64c63daa589cfa5edebe5cfa9bff1c45b08887f347f9a105d83650c3f7cb050859b1
SSDEEP

98304:rgk8iCoDu+GfOls2B4nCwB+j8FBfJmRHu55pnpDYMkfipcwalZLCwpokCFCxJD9K:kk8IKmkDM6l

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4844 3136 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4888 wrote to memory of 3136	4888	rundll32.exe	rundll32.exe
PID 4888 wrote to memory of 3136	4888	rundll32.exe	rundll32.exe
PID 4888 wrote to memory of 3136	4888	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jli.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4888

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jli.dll,#1
2⤵
PID:3136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3136 -s 728
3⤵
- Program crash
PID:4844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3136 -ip 3136
1⤵
PID:4828

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3136-0-0x0000000002C80000-0x00000000038F5000-memory.dmp

Filesize
12.5MB

Download
memory/3136-1-0x0000000002C80000-0x00000000038F5000-memory.dmp

Filesize
12.5MB

Download