4389f6fbbb6ecd15f872e419ef8e92bcde8c99e1d6ae98609c4cefb88aba4253 | Triage

Analysis

max time kernel
141s
max time network
130s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
25-11-2023 21:46

Sharing

Report Analysis Logs

General

Target

jli.dll
Size

12.4MB
MD5

e06b51fc094ab322ce2245be8349216c
SHA1

2c08c5a87615383289d8a83203dc2ecfdae3e0ab
SHA256

2d22f9065326574ffb475b1cbe2c4a15e9347a3dcb255e0bf1652d9fd9a63374
SHA512

076e5a91c96da1eda1dd30821ecaf63b2a2380b0348d5a04944b8e16678d64c63daa589cfa5edebe5cfa9bff1c45b08887f347f9a105d83650c3f7cb050859b1
SSDEEP

98304:rgk8iCoDu+GfOls2B4nCwB+j8FBfJmRHu55pnpDYMkfipcwalZLCwpokCFCxJD9K:kk8IKmkDM6l

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1172 1524 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 3064 wrote to memory of 1524	3064	rundll32.exe	rundll32.exe
PID 3064 wrote to memory of 1524	3064	rundll32.exe	rundll32.exe
PID 3064 wrote to memory of 1524	3064	rundll32.exe	rundll32.exe
PID 3064 wrote to memory of 1524	3064	rundll32.exe	rundll32.exe
PID 3064 wrote to memory of 1524	3064	rundll32.exe	rundll32.exe
PID 3064 wrote to memory of 1524	3064	rundll32.exe	rundll32.exe
PID 3064 wrote to memory of 1524	3064	rundll32.exe	rundll32.exe
PID 1524 wrote to memory of 1172	1524	rundll32.exe	WerFault.exe
PID 1524 wrote to memory of 1172	1524	rundll32.exe	WerFault.exe
PID 1524 wrote to memory of 1172	1524	rundll32.exe	WerFault.exe
PID 1524 wrote to memory of 1172	1524	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jli.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3064

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jli.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 288
3⤵
- Program crash
PID:1172

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1524-0-0x0000000002090000-0x0000000002D05000-memory.dmp

Filesize
12.5MB

Download
memory/1524-1-0x0000000002090000-0x0000000002D05000-memory.dmp

Filesize
12.5MB

Download