16f73fb34fae0f190c150ea6d34209852f8e7a023ce269ec082d9ef3f4375ba1 | Triage

Analysis

max time kernel
141s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 05:26

Sharing

Report Analysis Logs

General

Target

586km.comp222pSearcher910/mp.dll
Size

14KB
MD5

e561a29f5af13c3ad7c8f9c245f1320c
SHA1

94a89cd304e999e3c1ee1ad62a27f11363422e55
SHA256

b78eb55a655cbe0b5c2776c83ef82d3c92af987720476b0db7a9c340dba5a626
SHA512

146736de81649352f3b2d6b973145877279d76ece192e9acc5b4afd5cf856e8508c843ec1df756714f650f5ea8536a15d82dcdbf2ba2deb9d7b912be66574f20
SSDEEP

384:KX5h+mSXLnhqM520+CNbVGa2XKlTW3iNyHrO:K5hmh1520XbUa2aLNwrO

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3204	700	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 700	1568	rundll32.exe	90
PID 1568 wrote to memory of 700	1568	rundll32.exe	90
PID 1568 wrote to memory of 700	1568	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\586km.comp222pSearcher910\mp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\586km.comp222pSearcher910\mp.dll,#1
  2⤵
  PID:700
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 604
    3⤵
    - Program crash
    PID:3204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 700 -ip 700
1⤵
PID:1500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/700-0-0x0000000000BB0000-0x0000000000C06000-memory.dmp

Filesize
344KB

Download