e8582220f161aef10bcba30369f4d9a3f2a53024b9cd4a5f9f9fecfb98ba8be2 | Triage

Analysis

max time kernel
174s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 07:12

Sharing

Report Analysis Logs

General

Target

WindowBlinds/smart.dll
Size

36KB
MD5

c904da5b9b2c5a3109a19c3253036857
SHA1

660a1072b3b7223f2dc39e8a76511ce0da7b89b3
SHA256

34a10a06eec4617bc2e8ce45b9798e93444f40aaca2d784a39764a7084537c21
SHA512

96ebd1973f0c4cfc0943a2539abd8bf692a5585de984ef61c20b2a8bb19fba28c994f79051acb33c7d99ea42fd0a7c32b0811dc088a8a4c060626f5d0c611089
SSDEEP

384:/tQtSH1WJETUqTha67WM8qLBc4cml8YnyDcdN6OM5KSKez0o:1Q64qT86yMxLSynH6R1Kez

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2144	3472	WerFault.exe	91

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 3472	900	rundll32.exe	91
PID 900 wrote to memory of 3472	900	rundll32.exe	91
PID 900 wrote to memory of 3472	900	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\WindowBlinds\smart.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\WindowBlinds\smart.dll,#1
  2⤵
  PID:3472
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3472 -s 612
    3⤵
    - Program crash
    PID:2144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3472 -ip 3472
1⤵
PID:4680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads