96b272edba2bba68f40e6e6929d6ade64bfcc156af6a14dc36b360e64ca54393 | Triage

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 07:41

Sharing

Report Analysis Logs

General

Target

0f93ebd56b8fc53a9ac4e230d12c43c9.dll
Size

61KB
MD5

0f93ebd56b8fc53a9ac4e230d12c43c9
SHA1

8f80e08aabd1265717afed3b06e622d41ff43e08
SHA256

96b272edba2bba68f40e6e6929d6ade64bfcc156af6a14dc36b360e64ca54393
SHA512

727a705bf60673f9a77834dad70db6c21e1236d99d9c95e636c976f71e4aaa07d504fa2b9063f518a9adb83c9fe7128523d4dbc3d62de8770406e2df41b64cc2
SSDEEP

1536:FyD2Pu4hmQDy+eOTc5xHy2kI/lPdWcXs9qgRO:FyqPjmqW5y2kINPnXjgRO

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4740	1420	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3876 wrote to memory of 1420	3876	rundll32.exe	90
PID 3876 wrote to memory of 1420	3876	rundll32.exe	90
PID 3876 wrote to memory of 1420	3876	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f93ebd56b8fc53a9ac4e230d12c43c9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f93ebd56b8fc53a9ac4e230d12c43c9.dll,#1
  2⤵
  PID:1420
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 568
    3⤵
    - Program crash
    PID:4740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1420 -ip 1420
1⤵
PID:4780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads