372395908c40e8f2e8cd3c0567c31e7fd65a8e664f28715af246f820de25c88c | Triage

Analysis

max time kernel
142s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 06:47

Sharing

Report Analysis Logs

General

Target

11676ce1f8fa41957502ede3728cec81.dll
Size

59KB
MD5

11676ce1f8fa41957502ede3728cec81
SHA1

24c39b05d3ada482b477418b9b57bf0b11e04ae4
SHA256

372395908c40e8f2e8cd3c0567c31e7fd65a8e664f28715af246f820de25c88c
SHA512

fccd217080903ea4515aa472145cbe2ce3db915d563e3b15b5eea18d16e5185577de0e8913b581ddaf84f333bb75075f186d59d147874c522465f1f406295465
SSDEEP

1536:uiUCva6kctduSAxt8u6lsVHWZTnBJwNoT1E:uOS6kcvcxYtBJH

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4964	1460	WerFault.exe	15

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3500 wrote to memory of 1460	3500	rundll32.exe	15
PID 3500 wrote to memory of 1460	3500	rundll32.exe	15
PID 3500 wrote to memory of 1460	3500	rundll32.exe	15

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\11676ce1f8fa41957502ede3728cec81.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3500
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\11676ce1f8fa41957502ede3728cec81.dll,#1
  2⤵
  PID:1460
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1460 -s 624
    3⤵
    - Program crash
    PID:4964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1460 -ip 1460
1⤵
PID:5044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1460-0-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download