513e9a0e911990eb66e6dc75089de12bb9dafeab84761d2ce04d0bca1ed3dcfb | Triage

Analysis

max time kernel
146s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 16:12

Sharing

Report Analysis Logs

General

Target

2c1988db0fbce8981fb0027f4be91be5.dll
Size

114KB
MD5

2c1988db0fbce8981fb0027f4be91be5
SHA1

3a453f958509d66830f4d3235da90f6cd6b0aeeb
SHA256

513e9a0e911990eb66e6dc75089de12bb9dafeab84761d2ce04d0bca1ed3dcfb
SHA512

8d89af51132b14439c0aaf271cf1ba7708cfcf303d373aa408a38559756f3e725a67843da70deadb3d8804bce10dcec998430f98bdf48e15465213737c4890fb
SSDEEP

3072:0VTPlRv9sB48ImmSy6sRVnfEZbDwZKlL/FYa:0NXVoNeSP2V0

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2036	1584	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 1584	1716	rundll32.exe	14
PID 1716 wrote to memory of 1584	1716	rundll32.exe	14
PID 1716 wrote to memory of 1584	1716	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c1988db0fbce8981fb0027f4be91be5.dll,#1
1⤵
PID:1584
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1584 -s 556
  2⤵
  - Program crash
  PID:2036

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c1988db0fbce8981fb0027f4be91be5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1584 -ip 1584
1⤵
PID:3356

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1584-0-0x0000000010000000-0x0000000010046000-memory.dmp

Filesize
280KB

Download