d4720fbadd18ebce1c854925d8bc71d6772f9855773b7fa5260f1817a19bad21 | Triage

Analysis

max time kernel
136s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 20:52

Sharing

Report Analysis Logs

General

Target

03b066246003814bde75b991b45208c8.dll
Size

99KB
MD5

03b066246003814bde75b991b45208c8
SHA1

cc68211c3f5db2c23d2f54433f41a18e22bcbc6c
SHA256

d4720fbadd18ebce1c854925d8bc71d6772f9855773b7fa5260f1817a19bad21
SHA512

1e62b4493f45cc1bba947f850f18f9fa6460267ea130082a3216437200126eec8343385e88afaccd53ab53eac1e3276c5994f56ad29d89d2e944cbd70c755f03
SSDEEP

3072:/501wxblRZ/RVXVdMvxFQLvHvtiW2MSK:/9xjxbMxWLvHc

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
664	744	WerFault.exe	15

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 744	4696	regsvr32.exe	15
PID 4696 wrote to memory of 744	4696	regsvr32.exe	15
PID 4696 wrote to memory of 744	4696	regsvr32.exe	15

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\03b066246003814bde75b991b45208c8.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\03b066246003814bde75b991b45208c8.dll
  2⤵
  PID:744
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 744 -s 616
    3⤵
    - Program crash
    PID:664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 744 -ip 744
1⤵
PID:2548

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/744-0-0x0000000000550000-0x0000000000597000-memory.dmp

Filesize
284KB

Download