e62374c6afacd557248af86ef93831f77e5fb5c948ae2ed13ca1eb0c51bf0e52 | Triage

Analysis

max time kernel
92s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 18:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

351af89269b215b9652a5188c9de9b2d.dll
Size

81KB
MD5

351af89269b215b9652a5188c9de9b2d
SHA1

56c51c5e1eb1acd77f9478bae415efb7b4ae5c0d
SHA256

e62374c6afacd557248af86ef93831f77e5fb5c948ae2ed13ca1eb0c51bf0e52
SHA512

40873a09f008cebc2b7ef060ff22bb19d5787be5ad69645a1570571a48c0ef5312ccc29df07534a46843d710ecbf3011bb466e4fc590502b2bebf5d7463d3e8b
SSDEEP

1536:CyZEGuV6x0sSe5ibwZLKc+21xlU/csKz:CyW9VwCbkL3KZK

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5056	1732	WerFault.exe	18

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 428 wrote to memory of 1732	428	rundll32.exe	18
PID 428 wrote to memory of 1732	428	rundll32.exe	18
PID 428 wrote to memory of 1732	428	rundll32.exe	18

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\351af89269b215b9652a5188c9de9b2d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:428
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\351af89269b215b9652a5188c9de9b2d.dll,#1
  2⤵
  PID:1732
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 544
    3⤵
    - Program crash
    PID:5056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1732 -ip 1732
1⤵
PID:2744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1732-0-0x0000000010000000-0x0000000010029000-memory.dmp

Filesize
164KB

Download