84262134dce872bd14fc8cc79d3dc7cea0e20b713b4e3f12848f1588e83e7335 | Triage

Analysis

max time kernel
169s
max time network
187s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 14:28

Sharing

Report Analysis Logs

General

Target

00ea5af224c3f95b579266663db607dd.dll
Size

1.4MB
MD5

00ea5af224c3f95b579266663db607dd
SHA1

b0f550f4f91ea2a045cd27cbad9985a59b368a8e
SHA256

84262134dce872bd14fc8cc79d3dc7cea0e20b713b4e3f12848f1588e83e7335
SHA512

dceb9ddb52ce2f1eda793340e3c07fd308e3bd7bc1f7d5dd69c8def05ef1e8872a50ba1cef776325ed9e1f015c70c2128b2e626d2ae3c5deb65b388a6ce5098d
SSDEEP

6144:japwArJfrOAAZaSspTBlvhPUERlvhYedf:e3aAAVspT3vhXRjY6f

Score

3^/10

Malware Config

Signatures

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3784	1540	WerFault.exe	14
5048	1540	WerFault.exe	14

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3728 wrote to memory of 1540	3728	rundll32.exe	14
PID 3728 wrote to memory of 1540	3728	rundll32.exe	14
PID 3728 wrote to memory of 1540	3728	rundll32.exe	14
PID 1540 wrote to memory of 3784	1540	rundll32.exe	93
PID 1540 wrote to memory of 3784	1540	rundll32.exe	93
PID 1540 wrote to memory of 3784	1540	rundll32.exe	93

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\00ea5af224c3f95b579266663db607dd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 612
  2⤵
  - Program crash
  PID:3784
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 612
  2⤵
  - Program crash
  PID:5048

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\00ea5af224c3f95b579266663db607dd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 1540 -ip 1540
1⤵
PID:760

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads