48635f691c02d62bb1d344f7072553dbb5a22be588f822fe1a9f235628cce880 | Triage

Analysis

max time kernel
143s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 14:18

Sharing

Report Analysis Logs

General

Target

1b32d47fdadda86bd2826ef333050185.dll
Size

72KB
MD5

1b32d47fdadda86bd2826ef333050185
SHA1

66639343e7bb86125d47f94487376a15569339cf
SHA256

48635f691c02d62bb1d344f7072553dbb5a22be588f822fe1a9f235628cce880
SHA512

9a28bc18389d253751e6440feaf8c2677371d0ebecb54e1554d6c1d6098339f9ed96263741d98aae16647704e4093c2ea9886a6174c0fe9288b42f804d689a1b
SSDEEP

1536:Y0wqHOAQBoANnWmSAYzIt3GdZlFvYK3c9w8l:hY3NnWqI7k

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2540	2212	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 772 wrote to memory of 2212	772	rundll32.exe	88
PID 772 wrote to memory of 2212	772	rundll32.exe	88
PID 772 wrote to memory of 2212	772	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b32d47fdadda86bd2826ef333050185.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:772
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b32d47fdadda86bd2826ef333050185.dll,#1
  2⤵
  PID:2212
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 744
    3⤵
    - Program crash
    PID:2540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2212 -ip 2212
1⤵
PID:4840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2212-0-0x0000000000890000-0x00000000008BB000-memory.dmp

Filesize
172KB

Download
memory/2212-1-0x0000000000890000-0x00000000008BB000-memory.dmp

Filesize
172KB

Download