def4f0e2221314598f08b56d0fc35f169b2c67df22ce67d685fea66b374a6556 | Triage

Analysis

max time kernel
147s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 22:18

Sharing

Report Analysis Logs

General

Target

Thunder/Program/BugReportU.dll
Size

65KB
MD5

753eccd625b83be8f228ce20a580d661
SHA1

c8fa563948f812ff8240eaf63dc316022a73fb75
SHA256

7067a0a9fa9f733bd2a78b461cfcf2d1a464e69e68398c71b075974663509423
SHA512

c0a4ac0d8a874d2fc7b25d649798c8b442c6625f991eb38a6ec0a05b2609a354410741f0d4ccdff17439a3659e400dce56258b5c7b77aba3f1a768e5b293f510
SSDEEP

1536:8j1YpvXiXSz1wKFo7Rv4frKJZA+52Lt5nRpq:61YpeSz1N+UrKJZ92Lt5a

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4748	3868	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 3868	2068	rundll32.exe	84
PID 2068 wrote to memory of 3868	2068	rundll32.exe	84
PID 2068 wrote to memory of 3868	2068	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Thunder\Program\BugReportU.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Thunder\Program\BugReportU.dll,#1
  2⤵
  PID:3868
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 632
    3⤵
    - Program crash
    PID:4748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3868 -ip 3868
1⤵
PID:2996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads