98184786c4cf8300c5848307f96f2251764f3da8e4c0eda81da474f8d8ab9979 | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 01:14

Sharing

Report Analysis Logs

General

Target

09ba099e04c9a897eb8f970636f2d34a.dll
Size

16KB
MD5

09ba099e04c9a897eb8f970636f2d34a
SHA1

a27b274b875bb27ddf021b345ba03b2378619fb3
SHA256

98184786c4cf8300c5848307f96f2251764f3da8e4c0eda81da474f8d8ab9979
SHA512

21d214f914e3f4edb94818572945d48f7e28a98356395ca8e7711e5cfb53765d282b1ba2ef6cf4131d0e866d5a348136f69e0f6cae359a53b1ed2fae86d71164
SSDEEP

384:FTgDfPghDxYC6a2lUl8G7mX2nIHMVcDYQHGvpDp5:FcwR6W8GZwH2D7

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3036	2948	WerFault.exe	14

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2948	2932	rundll32.exe	14
PID 2932 wrote to memory of 2948	2932	rundll32.exe	14
PID 2932 wrote to memory of 2948	2932	rundll32.exe	14
PID 2932 wrote to memory of 2948	2932	rundll32.exe	14
PID 2932 wrote to memory of 2948	2932	rundll32.exe	14
PID 2932 wrote to memory of 2948	2932	rundll32.exe	14
PID 2932 wrote to memory of 2948	2932	rundll32.exe	14
PID 2948 wrote to memory of 3036	2948	rundll32.exe	15
PID 2948 wrote to memory of 3036	2948	rundll32.exe	15
PID 2948 wrote to memory of 3036	2948	rundll32.exe	15
PID 2948 wrote to memory of 3036	2948	rundll32.exe	15

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\09ba099e04c9a897eb8f970636f2d34a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 236
  2⤵
  - Program crash
  PID:3036

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\09ba099e04c9a897eb8f970636f2d34a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2948-1-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/2948-0-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/2948-2-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download