9f8d31b076fc7040f8f8569557e9caba3acdeff97e06835e07d4ca3679238e80 | Triage

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 09:51

Sharing

Report Analysis Logs

General

Target

650fcbe93292ffc37d3f5204cc40eef7.dll
Size

120KB
MD5

650fcbe93292ffc37d3f5204cc40eef7
SHA1

e01067d7c7c0589a728f2eaaecc77ef76ee8d408
SHA256

9f8d31b076fc7040f8f8569557e9caba3acdeff97e06835e07d4ca3679238e80
SHA512

83eb99adc725f93a36b779638a12c7fa186a4d83aa83c16eec673e1f03b928a1cbe553638ca68a273b2defe14b794198597643583d3b0437b283123a2d9b9d46
SSDEEP

1536:tNqMQlu4XMKTwjaDKj+VeK6TV6P19UCRg1gOVAa:bmu4jTwj1JKMGgCRgaa

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4936	3980	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 3980	2800	regsvr32.exe	88
PID 2800 wrote to memory of 3980	2800	regsvr32.exe	88
PID 2800 wrote to memory of 3980	2800	regsvr32.exe	88

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\650fcbe93292ffc37d3f5204cc40eef7.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\650fcbe93292ffc37d3f5204cc40eef7.dll
  2⤵
  PID:3980
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3980 -s 636
    3⤵
    - Program crash
    PID:4936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3980 -ip 3980
1⤵
PID:4280

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3980-0-0x00000000005A0000-0x00000000005BE000-memory.dmp

Filesize
120KB

Download