9bb396922b20e326787175e60a2b55273ce83568a5bdd479e4555f1f6e0c0b43 | Triage

Analysis

max time kernel
141s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19-12-2023 14:48

Sharing

Report Analysis Logs

General

Target

1.dll
Size

877KB
MD5

2a47eb66cd368a15415235a5e907157d
SHA1

3aad7acf87ff1c5ce1a67480b3cd2e5f5b566288
SHA256

9bb396922b20e326787175e60a2b55273ce83568a5bdd479e4555f1f6e0c0b43
SHA512

bc33ef5897dcc9c3b189221a057dfc156bd1ea3dc9b9d2432985541a531a2b5013d2728297cb846cb6f3ba94c0bfdc8b6382862b88a88c6d8203ba6921c0a06a
SSDEEP

12288:/HWgyKilKLVIYK+QizbzmWR5eIi3Ld0MIEX6SZW4Abw0jaffcBc0v0BJ:/HGbWQi/SbIix0FEXtILjx

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1456	1364	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 1364	4476	rundll32.exe	86
PID 4476 wrote to memory of 1364	4476	rundll32.exe	86
PID 4476 wrote to memory of 1364	4476	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1.dll,#1
  2⤵
  PID:1364
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1364 -s 644
    3⤵
    - Program crash
    PID:1456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1364 -ip 1364
1⤵
PID:3236

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads