b785849f74f521f165cc2bfb0c0e8f63b115dd3abf159598c9d38935510c11a8 | Triage

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 08:25

Sharing

Report Analysis Logs

General

Target

135958be1abc8bec16b8ee5c4be4a2da.dll
Size

72KB
MD5

135958be1abc8bec16b8ee5c4be4a2da
SHA1

79fdf80bfebde320176f1ce4f01042e44715e1bf
SHA256

b785849f74f521f165cc2bfb0c0e8f63b115dd3abf159598c9d38935510c11a8
SHA512

d4b0812b4261f0bfaaed2f846a577b3838cc0235f74ac048f721158b877481b809e7d194f1b2d788ee5d7ed494682e1711a6917ccc21050017be992c50426c87
SSDEEP

1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuv:C5UOq0ukgOK2l7aFQv

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4224	216	WerFault.exe	16

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 216	4648	rundll32.exe	16
PID 4648 wrote to memory of 216	4648	rundll32.exe	16
PID 4648 wrote to memory of 216	4648	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\135958be1abc8bec16b8ee5c4be4a2da.dll,#1
1⤵
PID:216
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 216 -s 600
  2⤵
  - Program crash
  PID:4224

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\135958be1abc8bec16b8ee5c4be4a2da.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 216 -ip 216
1⤵
PID:220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads