6a85a68cbbce8aedb5c6588f85d41184c8993315907aa648bfae25d31648198a | Triage

Analysis

max time kernel
144s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 13:40

Sharing

Report Analysis Logs

General

Target

酷客精灵/Kernel.dll
Size

1.2MB
MD5

690da87e49616ac0f29f6c628b87ae02
SHA1

3f22d0b209e196c54bb1801684d05b3688ec1187
SHA256

1a2ef7760ec0a73adf48a0f9e41455867ec5391b9cf48b0c9b6224ee212aa32a
SHA512

621e2b77394e6e3f0ff91c8a3846ba2938ac01c16ef4ff3ff1ad76bd651bb0c50614f07a7e102f9699487fea5ce205ca90d93d9ff642e410a1e9f396c3be889b
SSDEEP

24576:yIiOb5nP80rHSBGeNrer+XOET++Erd+3X:yCNn00TSB1Jer+XOd+O+3

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2852	2560	WerFault.exe	13

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2560	rundll32.exe
2560	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 2560	3008	rundll32.exe	13
PID 3008 wrote to memory of 2560	3008	rundll32.exe	13
PID 3008 wrote to memory of 2560	3008	rundll32.exe	13

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\酷客精灵\Kernel.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\酷客精灵\Kernel.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2560
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 664
    3⤵
    - Program crash
    PID:2852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2560 -ip 2560
1⤵
PID:4392

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads