8e1006e5f230f269bb9ce80e5c2b7f3b930cb68f3d975697d45b4e4bae33ce58 | Triage

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2023 00:16

Sharing

Report Analysis Logs

General

Target

getword/GetWordDemo/GetWord.dll
Size

92KB
MD5

8cbc928d295827bee94e4987cf1f064a
SHA1

6b628b0dc872d328b9266bbbde23157f284f1831
SHA256

9d34f20efc1138c893bdcd24b7b65962c012541bb38cc064d4e438a382262723
SHA512

fdf4f4c1af267e27233be512e3e5c2876dd06474f1a333c79dc3bdf660040e21c85f5d39751e34871a025e4dede113f9747a5e70daa1d881b1ef409282028288
SSDEEP

1536:fzel4+/L5Dei33WwgWmDc5df4p7eRzgS5M+Qij:f+4653Ww75dkS5MAj

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
32	4060	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3688 wrote to memory of 4060	3688	rundll32.exe	88
PID 3688 wrote to memory of 4060	3688	rundll32.exe	88
PID 3688 wrote to memory of 4060	3688	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\getword\GetWordDemo\GetWord.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3688
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\getword\GetWordDemo\GetWord.dll,#1
  2⤵
  PID:4060
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 620
    3⤵
    - Program crash
    PID:32

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4060 -ip 4060
1⤵
PID:1740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads