63e9f9e80d9aa9b8511c01c1d4897e8c6041b758699dabf8b993e14d8868d092 | Triage

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 05:35

Sharing

Report Analysis Logs

General

Target

08706451a23006d83dddad783a8294cf.dll
Size

944KB
MD5

08706451a23006d83dddad783a8294cf
SHA1

f6e5eecff8b6a1b240e3c0c4f56878060fa6e07c
SHA256

63e9f9e80d9aa9b8511c01c1d4897e8c6041b758699dabf8b993e14d8868d092
SHA512

72b7d0b69b549c994c47e376ffb9d35c72b60f21d1899c60017b73af7f423681d29981aa8ad46c4cc84f3d89e24060d097975671b2fd13d6896c165993ee01e4
SSDEEP

24576:MfsTsvYLPBZQXcFMiOWmQWU2mSMkDROJ3dztk8XCg:nDOFmuROJ7C

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2816	2940	WerFault.exe	14

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 2940	2892	rundll32.exe	14
PID 2892 wrote to memory of 2940	2892	rundll32.exe	14
PID 2892 wrote to memory of 2940	2892	rundll32.exe	14
PID 2892 wrote to memory of 2940	2892	rundll32.exe	14
PID 2892 wrote to memory of 2940	2892	rundll32.exe	14
PID 2892 wrote to memory of 2940	2892	rundll32.exe	14
PID 2892 wrote to memory of 2940	2892	rundll32.exe	14
PID 2940 wrote to memory of 2816	2940	rundll32.exe	15
PID 2940 wrote to memory of 2816	2940	rundll32.exe	15
PID 2940 wrote to memory of 2816	2940	rundll32.exe	15
PID 2940 wrote to memory of 2816	2940	rundll32.exe	15

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\08706451a23006d83dddad783a8294cf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2940 -s 264
  2⤵
  - Program crash
  PID:2816

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\08706451a23006d83dddad783a8294cf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2940-0-0x0000000000890000-0x0000000000988000-memory.dmp

Filesize
992KB

Download
memory/2940-1-0x0000000000890000-0x0000000000988000-memory.dmp

Filesize
992KB

Download