63e9f9e80d9aa9b8511c01c1d4897e8c6041b758699dabf8b993e14d8868d092 | Triage

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 05:35

Sharing

Report Analysis Logs

General

Target

08706451a23006d83dddad783a8294cf.dll
Size

944KB
MD5

08706451a23006d83dddad783a8294cf
SHA1

f6e5eecff8b6a1b240e3c0c4f56878060fa6e07c
SHA256

63e9f9e80d9aa9b8511c01c1d4897e8c6041b758699dabf8b993e14d8868d092
SHA512

72b7d0b69b549c994c47e376ffb9d35c72b60f21d1899c60017b73af7f423681d29981aa8ad46c4cc84f3d89e24060d097975671b2fd13d6896c165993ee01e4
SSDEEP

24576:MfsTsvYLPBZQXcFMiOWmQWU2mSMkDROJ3dztk8XCg:nDOFmuROJ7C

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1552	1544	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4144 wrote to memory of 1544	4144	rundll32.exe	14
PID 4144 wrote to memory of 1544	4144	rundll32.exe	14
PID 4144 wrote to memory of 1544	4144	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\08706451a23006d83dddad783a8294cf.dll,#1
1⤵
PID:1544
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 680
  2⤵
  - Program crash
  PID:1552

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\08706451a23006d83dddad783a8294cf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1544 -ip 1544
1⤵
PID:4336

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1544-0-0x0000000002B80000-0x0000000002C78000-memory.dmp

Filesize
992KB

Download
memory/1544-1-0x0000000002B80000-0x0000000002C78000-memory.dmp

Filesize
992KB

Download