e7ef76c6b7a26f2f08b2214bfe6e191bd7620b6b4e7128ee815deb17b1ef1c41 | Triage

Analysis

max time kernel
147s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2023 15:45

Sharing

Report Analysis Logs

General

Target

79e8acafa48b26f72f64f36b4955ac6e.dll
Size

6KB
MD5

79e8acafa48b26f72f64f36b4955ac6e
SHA1

3ebbbfd5f8f4b00db01b11972b0fb321d1abe631
SHA256

e7ef76c6b7a26f2f08b2214bfe6e191bd7620b6b4e7128ee815deb17b1ef1c41
SHA512

e8d8d431b6adeb2db746cdb1e4982559bee939785fa2a656ac221bc84fac85ba832ad9616f001764fb8b405353c6c358937fdc2f697267634dce36a94acb34f7
SSDEEP

48:gpkg++Zs4/Cx/CqeZlEfiOevQYk3MSuSFRT3BVTLhL4fFkk:M2aXY/YQYkhl3BVnhJ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4632	2584	WerFault.exe	50

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4048 wrote to memory of 2584	4048	rundll32.exe	50
PID 4048 wrote to memory of 2584	4048	rundll32.exe	50
PID 4048 wrote to memory of 2584	4048	rundll32.exe	50

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\79e8acafa48b26f72f64f36b4955ac6e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\79e8acafa48b26f72f64f36b4955ac6e.dll,#1
  2⤵
  PID:2584
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 560
    3⤵
    - Program crash
    PID:4632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2584 -ip 2584
1⤵
PID:3980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2584-0-0x0000000025000000-0x0000000025012000-memory.dmp

Filesize
72KB

Download