4389f6fbbb6ecd15f872e419ef8e92bcde8c99e1d6ae98609c4cefb88aba4253 | Triage

Analysis

max time kernel
140s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2023, 21:45

Sharing

Report Analysis Logs

General

Target

jli.dll
Size

12.4MB
MD5

e06b51fc094ab322ce2245be8349216c
SHA1

2c08c5a87615383289d8a83203dc2ecfdae3e0ab
SHA256

2d22f9065326574ffb475b1cbe2c4a15e9347a3dcb255e0bf1652d9fd9a63374
SHA512

076e5a91c96da1eda1dd30821ecaf63b2a2380b0348d5a04944b8e16678d64c63daa589cfa5edebe5cfa9bff1c45b08887f347f9a105d83650c3f7cb050859b1
SSDEEP

98304:rgk8iCoDu+GfOls2B4nCwB+j8FBfJmRHu55pnpDYMkfipcwalZLCwpokCFCxJD9K:kk8IKmkDM6l

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1728	4500	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3580 wrote to memory of 4500	3580	rundll32.exe	84
PID 3580 wrote to memory of 4500	3580	rundll32.exe	84
PID 3580 wrote to memory of 4500	3580	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jli.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3580
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\jli.dll,#1
  2⤵
  PID:4500
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4500 -s 728
    3⤵
    - Program crash
    PID:1728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4500 -ip 4500
1⤵
PID:3296

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4500-0-0x0000000002790000-0x0000000003405000-memory.dmp

Filesize
12.5MB

Download
memory/4500-1-0x0000000002790000-0x0000000003405000-memory.dmp

Filesize
12.5MB

Download