55dfb0fa2c21cdd43f8ddaec491ffba83cd6d55c80a4e15400dea368c9c85609 | Triage

Analysis

max time kernel
152s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 14:03

Sharing

Report Analysis Logs

General

Target

1ae22bb10ef3b95f2c1976d45fcc1f7d.dll
Size

22KB
MD5

1ae22bb10ef3b95f2c1976d45fcc1f7d
SHA1

bed2602c9608c8a37c7a11360af656a611266607
SHA256

55dfb0fa2c21cdd43f8ddaec491ffba83cd6d55c80a4e15400dea368c9c85609
SHA512

6aa5a74013506d7dbc420847944a15d1d5ab0991599f4d7f9eca9849b7ce3cde3ee8ac5238c23a11585bc50f79e597dc3028163fa7913ca00de3296cf4beaa9e
SSDEEP

384:OcK1Da7xNuxw1bkByZTGQEJL5IQHR/RFkGZgTXgT:OcK1DMzuxwpuyPO15HpZs

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2064	1456	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3560 wrote to memory of 1456	3560	rundll32.exe	88
PID 3560 wrote to memory of 1456	3560	rundll32.exe	88
PID 3560 wrote to memory of 1456	3560	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1ae22bb10ef3b95f2c1976d45fcc1f7d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3560
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1ae22bb10ef3b95f2c1976d45fcc1f7d.dll,#1
  2⤵
  PID:1456
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 636
    3⤵
    - Program crash
    PID:2064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1456 -ip 1456
1⤵
PID:4680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1456-0-0x0000000060380000-0x000000006038D000-memory.dmp

Filesize
52KB

Download
memory/1456-1-0x0000000060380000-0x000000006038D000-memory.dmp

Filesize
52KB

Download