747877b7da71b1d9388b3864c4d37874abc97fccf035a29d84aacb6d3dc69a50 | Triage

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 20:57

Sharing

Report Analysis Logs

General

Target

1c5203c9399b6d6ff7ea4187df9ef579.dll
Size

72KB
MD5

1c5203c9399b6d6ff7ea4187df9ef579
SHA1

6bf3d11e25fda3b6b25410768ee370669cfaa4c0
SHA256

747877b7da71b1d9388b3864c4d37874abc97fccf035a29d84aacb6d3dc69a50
SHA512

10247f0f72b89fece62bd703406c44f67a5c44dc9fc1b6de40a9df88b50f46a6606bf6d09e770ebb7c54f22d4431e068dcb1e925e696b77ff82b8ab0d8f7127e
SSDEEP

1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuv:C5UOq0ukgOK2l7aFQv

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
464	4496	WerFault.exe	16

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 4496	2548	rundll32.exe	16
PID 2548 wrote to memory of 4496	2548	rundll32.exe	16
PID 2548 wrote to memory of 4496	2548	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1c5203c9399b6d6ff7ea4187df9ef579.dll,#1
1⤵
PID:4496
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 600
  2⤵
  - Program crash
  PID:464

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1c5203c9399b6d6ff7ea4187df9ef579.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4496 -ip 4496
1⤵
PID:400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads