bb4637edcce1d17f7b521aaf2f1302a0af21d9ba0bab9545c6c31fd63af9703e | Triage

Analysis

max time kernel
138s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 01:41

Sharing

Report Analysis Logs

General

Target

0a6dc062988aafc8d85de1ef9ee13278.dll
Size

250KB
MD5

0a6dc062988aafc8d85de1ef9ee13278
SHA1

a8e010d7829a68aaf00cf8a6dc97d3c8da05568a
SHA256

bb4637edcce1d17f7b521aaf2f1302a0af21d9ba0bab9545c6c31fd63af9703e
SHA512

a157aec4947208a16ba4304a4503522fc543f8440b6a9e33cb43d9e167d0486aab44142fcef5897740ec882208be98d425d2a0bc81ec67a17995099f30e680d0
SSDEEP

6144:TjGdKoizOkxc+D16Paxr7w8T98ZWrGP624og:TjiMzsMPbK5PYl

Score

3^/10

Malware Config

Signatures

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4404	3248	WerFault.exe	14
3816	3248	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1428 wrote to memory of 3248	1428	rundll32.exe	14
PID 1428 wrote to memory of 3248	1428	rundll32.exe	14
PID 1428 wrote to memory of 3248	1428	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0a6dc062988aafc8d85de1ef9ee13278.dll,#1
1⤵
PID:3248
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3248 -s 620
  2⤵
  - Program crash
  PID:4404
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3248 -s 856
  2⤵
  - Program crash
  PID:3816

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0a6dc062988aafc8d85de1ef9ee13278.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3248 -ip 3248
1⤵
PID:3576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3248 -ip 3248
1⤵
PID:2000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads