279ca8a8f93dc3083def7f96c556a79edfbabe9f076af188e09d997228679f62 | Triage

Analysis

max time kernel
155s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 09:20

Sharing

Report Analysis Logs

General

Target

1458737ce305287b5f48fd4c54b1060d.dll
Size

72KB
MD5

1458737ce305287b5f48fd4c54b1060d
SHA1

839c60e8d5cb5b51aa690da918e4b9e14b379b61
SHA256

279ca8a8f93dc3083def7f96c556a79edfbabe9f076af188e09d997228679f62
SHA512

02a7272f1f2249a7c37da24eabc111747a1c002930f3d111ba7482d974e5176286b0f31d283282f21536996691765df14e24da91ad3d93ffd45ac2f8bb39749f
SSDEEP

1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuv:C5UOq0ukgOK2l7aFQv

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1596	4860	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3184 wrote to memory of 4860	3184	rundll32.exe	84
PID 3184 wrote to memory of 4860	3184	rundll32.exe	84
PID 3184 wrote to memory of 4860	3184	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1458737ce305287b5f48fd4c54b1060d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3184
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1458737ce305287b5f48fd4c54b1060d.dll,#1
  2⤵
  PID:4860
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4860 -s 608
    3⤵
    - Program crash
    PID:1596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4860 -ip 4860
1⤵
PID:3004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads