9f8f85a2766cde2e114d6bc85a7cbe37ab47ec3328501df38a15a8b4c5a3bbc0 | Triage

Analysis

max time kernel
136s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 15:58

Sharing

Report Analysis Logs

General

Target

2b2ddcab1aa3df804e88c62ff25fb12e.dll
Size

248KB
MD5

2b2ddcab1aa3df804e88c62ff25fb12e
SHA1

e599c00905a57e482595f2404c42bf8e06d8b802
SHA256

9f8f85a2766cde2e114d6bc85a7cbe37ab47ec3328501df38a15a8b4c5a3bbc0
SHA512

5522adcb4d15c8403973332fef7097f90fac35aee9d4f5d22ad14c49b19e87f036816145219bff06eb7f18621e45a5b56a24889352366ccf9443655cdb441da9
SSDEEP

6144:4dEjetZziZfOe+Abf/0xc8aLa3AsaJBTMK1L:TjenmfOhaUmrLa7wBbL

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3572	3532	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 3532	2200	rundll32.exe	88
PID 2200 wrote to memory of 3532	2200	rundll32.exe	88
PID 2200 wrote to memory of 3532	2200	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b2ddcab1aa3df804e88c62ff25fb12e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b2ddcab1aa3df804e88c62ff25fb12e.dll,#1
  2⤵
  PID:3532
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3532 -s 564
    3⤵
    - Program crash
    PID:3572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3532 -ip 3532
1⤵
PID:872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads