bbab3a416a1ba0ea7be29a967bc596421d5b08c00a101982f502bbf7878ba724 | Triage

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 13:24

Sharing

Report Analysis Logs

General

Target

19e31a444c5b3c3d19aba521dcb3e0e1.dll
Size

73KB
MD5

19e31a444c5b3c3d19aba521dcb3e0e1
SHA1

852c026dc02f2294da8c2cc8b685e599e46a5cb7
SHA256

bbab3a416a1ba0ea7be29a967bc596421d5b08c00a101982f502bbf7878ba724
SHA512

38f35db05d00f6507fa9384617cabd2ba5b4ac5585728e9ac986990a4a267f297a87b1e62ef1463b2763c4e761530ba6ff562f24eadef95ffa6ba8cf9d6c3344
SSDEEP

1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuv:C5UOq0ukgOK2l7aFQv

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1020	3160	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 3160	2744	rundll32.exe	14
PID 2744 wrote to memory of 3160	2744	rundll32.exe	14
PID 2744 wrote to memory of 3160	2744	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\19e31a444c5b3c3d19aba521dcb3e0e1.dll,#1
1⤵
PID:3160
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 608
  2⤵
  - Program crash
  PID:1020

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\19e31a444c5b3c3d19aba521dcb3e0e1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3160 -ip 3160
1⤵
PID:2024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads