84262134dce872bd14fc8cc79d3dc7cea0e20b713b4e3f12848f1588e83e7335 | Triage

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 14:28

Sharing

Report Analysis Logs

General

Target

00ea5af224c3f95b579266663db607dd.dll
Size

1.4MB
MD5

00ea5af224c3f95b579266663db607dd
SHA1

b0f550f4f91ea2a045cd27cbad9985a59b368a8e
SHA256

84262134dce872bd14fc8cc79d3dc7cea0e20b713b4e3f12848f1588e83e7335
SHA512

dceb9ddb52ce2f1eda793340e3c07fd308e3bd7bc1f7d5dd69c8def05ef1e8872a50ba1cef776325ed9e1f015c70c2128b2e626d2ae3c5deb65b388a6ce5098d
SSDEEP

6144:japwArJfrOAAZaSspTBlvhPUERlvhYedf:e3aAAVspT3vhXRjY6f

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2092	1104	WerFault.exe	16

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 1104	1724	rundll32.exe	16
PID 1724 wrote to memory of 1104	1724	rundll32.exe	16
PID 1724 wrote to memory of 1104	1724	rundll32.exe	16
PID 1724 wrote to memory of 1104	1724	rundll32.exe	16
PID 1724 wrote to memory of 1104	1724	rundll32.exe	16
PID 1724 wrote to memory of 1104	1724	rundll32.exe	16
PID 1724 wrote to memory of 1104	1724	rundll32.exe	16
PID 1104 wrote to memory of 2092	1104	rundll32.exe	17
PID 1104 wrote to memory of 2092	1104	rundll32.exe	17
PID 1104 wrote to memory of 2092	1104	rundll32.exe	17
PID 1104 wrote to memory of 2092	1104	rundll32.exe	17

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\00ea5af224c3f95b579266663db607dd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 224
  2⤵
  - Program crash
  PID:2092

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\00ea5af224c3f95b579266663db607dd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads