4389f6fbbb6ecd15f872e419ef8e92bcde8c99e1d6ae98609c4cefb88aba4253 | Triage

Analysis

max time kernel
141s
max time network
130s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
25-11-2023 21:46

Sharing

Report Analysis Logs

General

Target

jli.dll
Size

12.4MB
MD5

e06b51fc094ab322ce2245be8349216c
SHA1

2c08c5a87615383289d8a83203dc2ecfdae3e0ab
SHA256

2d22f9065326574ffb475b1cbe2c4a15e9347a3dcb255e0bf1652d9fd9a63374
SHA512

076e5a91c96da1eda1dd30821ecaf63b2a2380b0348d5a04944b8e16678d64c63daa589cfa5edebe5cfa9bff1c45b08887f347f9a105d83650c3f7cb050859b1
SSDEEP

98304:rgk8iCoDu+GfOls2B4nCwB+j8FBfJmRHu55pnpDYMkfipcwalZLCwpokCFCxJD9K:kk8IKmkDM6l

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1172	1524	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 1524	3064	rundll32.exe	28
PID 3064 wrote to memory of 1524	3064	rundll32.exe	28
PID 3064 wrote to memory of 1524	3064	rundll32.exe	28
PID 3064 wrote to memory of 1524	3064	rundll32.exe	28
PID 3064 wrote to memory of 1524	3064	rundll32.exe	28
PID 3064 wrote to memory of 1524	3064	rundll32.exe	28
PID 3064 wrote to memory of 1524	3064	rundll32.exe	28
PID 1524 wrote to memory of 1172	1524	rundll32.exe	29
PID 1524 wrote to memory of 1172	1524	rundll32.exe	29
PID 1524 wrote to memory of 1172	1524	rundll32.exe	29
PID 1524 wrote to memory of 1172	1524	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jli.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\jli.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1524
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 288
    3⤵
    - Program crash
    PID:1172

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1524-0-0x0000000002090000-0x0000000002D05000-memory.dmp

Filesize
12.5MB

Download
memory/1524-1-0x0000000002090000-0x0000000002D05000-memory.dmp

Filesize
12.5MB

Download