291ddc36e0f58d6852b736682cdb533e20d5fed0ede563cdaa2107a9445236e9 | Triage

Analysis

max time kernel
92s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 10:06

Sharing

Report Analysis Logs

General

Target

65fa4f1c3f77afe0f16fdd5620cc36de.dll
Size

3.6MB
MD5

65fa4f1c3f77afe0f16fdd5620cc36de
SHA1

31265dda8ff77c491762b6d3c11ac913c89e844a
SHA256

291ddc36e0f58d6852b736682cdb533e20d5fed0ede563cdaa2107a9445236e9
SHA512

f4fc628eb5e8a02216f66d81258453b66976e112a0a0211f16877188691c3f98b905d636f42fa65a8cc39ca798ec0a35dc7ec8c7e5e7a7a66cf36c457d1ae16a
SSDEEP

49152:cC0ciBETH/7qiS/1hpfEidJH+DRMpa4mIhTwazZU:cChb0hbKDReRmIT1

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4256	4212	WerFault.exe	19

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 4212	3372	rundll32.exe	19
PID 3372 wrote to memory of 4212	3372	rundll32.exe	19
PID 3372 wrote to memory of 4212	3372	rundll32.exe	19

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\65fa4f1c3f77afe0f16fdd5620cc36de.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\65fa4f1c3f77afe0f16fdd5620cc36de.dll,#1
  2⤵
  PID:4212
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4212 -s 668
    3⤵
    - Program crash
    PID:4256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4212 -ip 4212
1⤵
PID:2528

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4212-0-0x00000000022B0000-0x0000000002655000-memory.dmp

Filesize
3.6MB

Download
memory/4212-1-0x00000000022B0000-0x0000000002655000-memory.dmp

Filesize
3.6MB

Download