c557ef35306f3c41ffc576287d2f4b58ae34f7e6370c0f5f6e2d4f23839b0cd9 | Triage

Analysis

max time kernel
117s
max time network
126s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
27/11/2023, 01:55

Sharing

Report Analysis Logs

General

Target

libHarfBuzzSharp.dll
Size

893KB
MD5

eaa6c0d42c8967d86a39808806c49869
SHA1

0d73478de8d07446dc41c69ca8da606d3253e7ac
SHA256

8d5d5236f4d0fc61e1c5b3ecc69370061c06f3682cc4f339476d8a6c41bcd02a
SHA512

b159f620e57a77649416916e1626e3fe992fe6228521614478d50f5e02152d22d0290e673796e7e536b3de31e8d87ea5ec319a4b1d66db913bcf2dfe371f0063
SSDEEP

12288:O4ZNKi7qOgquHRhgq/R3vK/YNyQCOdNQLkDoyFigv9Vl:OKzTgqORhgq/9vErEILkDfFigv1

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2456	2252	rundll32.exe	28
PID 2252 wrote to memory of 2456	2252	rundll32.exe	28
PID 2252 wrote to memory of 2456	2252	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libHarfBuzzSharp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2252 -s 84
  2⤵
  PID:2456

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads