06e853a37e7fb86d2be7f24c152f1c93256e139a54dfd254d7bafdec6f0775b2 | Triage

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 07:34

Sharing

Report Analysis Logs

General

Target

create-tauri-app.win32-x64-msvc.dll
Size

935KB
MD5

460b35a8cf4ef86c9737a95307be15b0
SHA1

3128cc6d2afe526a6c705d507e4ee0edb0eb3fd2
SHA256

06e853a37e7fb86d2be7f24c152f1c93256e139a54dfd254d7bafdec6f0775b2
SHA512

52f1201f43a7e7688ee471e8a0bc00ab2699f7ba734a3bb96de1f6e5c7035882903066e27d181d05e3bd12c18703c6f4e482db7d51af96f24e5f3a2ce5caae84
SSDEEP

24576:55shA6BJOezObnda4xqtdQJNAjGfpO7Vz:55sqezOzdaHdQJ0r

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 2220	3060	rundll32.exe	28
PID 3060 wrote to memory of 2220	3060	rundll32.exe	28
PID 3060 wrote to memory of 2220	3060	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\create-tauri-app.win32-x64-msvc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3060 -s 112
  2⤵
  PID:2220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads