eabb567d402c51623e0563016748fdb1b8d701b6bcb0509eb65f8aa05d694162 | Triage

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 12:23

Sharing

Report Analysis Logs

General

Target

Lenin_Script/dll/edll.dll
Size

32KB
MD5

13321dfa8168da27a2a195bac2b66900
SHA1

aa277a8fae99b3c6a9f1b992a26d67997d51186e
SHA256

887e479d14e61e448e351c1c3d70f6acc04772ddc9fc41ab6bea8a1cae5d889f
SHA512

62b7f2d7e0edec0af6878ea944429ba37b5ea7fde6008a167f4709a94b40d640da652160bd5f91a77821046cd1d37027a1773e967efc38e281fec598d37c612f
SSDEEP

384:adLlKBrIx01Tv7A7P7W8b5mlF7yQjrZuU+cAEopXLCK1TZH:ULlErd1Tv7Iq8bEhjrZaEopvZ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1896	1532	WerFault.exe	91

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 1532	5088	rundll32.exe	91
PID 5088 wrote to memory of 1532	5088	rundll32.exe	91
PID 5088 wrote to memory of 1532	5088	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Lenin_Script\dll\edll.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Lenin_Script\dll\edll.dll,#1
  2⤵
  PID:1532
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 596
    3⤵
    - Program crash
    PID:1896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1532 -ip 1532
1⤵
PID:4596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads