c6e0fd3b2d1d22a7f17ad07265669733f91cf6b2fe51173312fb908fe27b0253 | Triage

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 13:16

Sharing

Report Analysis Logs

General

Target

718445ae997bf24afbf70d24322d47ad.dll
Size

296KB
MD5

718445ae997bf24afbf70d24322d47ad
SHA1

2e88d447f02ade23ab9b087305085ed6a6729562
SHA256

c6e0fd3b2d1d22a7f17ad07265669733f91cf6b2fe51173312fb908fe27b0253
SHA512

7c004fafe4ff854f9b3fc43c96fa147fa59ea633ec945643bc7ef33fbc5b249b82b5cde3cd2b8168feec01ed94e3752909c40104a8897f32f3a955e7e4a9489a
SSDEEP

6144:DVGlLr0fNXnRKU7Pt6S9ev2HodhTBYf8+nor:09BUf82IdhTiZ8

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process
2336	2680	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 2680	2844	rundll32.exe	17
PID 2844 wrote to memory of 2680	2844	rundll32.exe	17
PID 2844 wrote to memory of 2680	2844	rundll32.exe	17
PID 2844 wrote to memory of 2680	2844	rundll32.exe	17
PID 2844 wrote to memory of 2680	2844	rundll32.exe	17
PID 2844 wrote to memory of 2680	2844	rundll32.exe	17
PID 2844 wrote to memory of 2680	2844	rundll32.exe	17
PID 2680 wrote to memory of 2336	2680	rundll32.exe	16
PID 2680 wrote to memory of 2336	2680	rundll32.exe	16
PID 2680 wrote to memory of 2336	2680	rundll32.exe	16
PID 2680 wrote to memory of 2336	2680	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\718445ae997bf24afbf70d24322d47ad.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\718445ae997bf24afbf70d24322d47ad.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2680 -s 288
1⤵
- Program crash
PID:2336

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads