bf0ce7afa61968a7c8eb514b3b4f62a7d808c4a7954c5a2f3b4e6bc00e5f6245 | Triage

Analysis

max time kernel
148s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2023 02:38

Sharing

Report Analysis Logs

General

Target

24c56dc4caf00a0cdf23e6472af7a287.dll
Size

26KB
MD5

24c56dc4caf00a0cdf23e6472af7a287
SHA1

f8d86c0cf1f638ad6703b41ae0a459acd60c7584
SHA256

bf0ce7afa61968a7c8eb514b3b4f62a7d808c4a7954c5a2f3b4e6bc00e5f6245
SHA512

38fcdae7c715d21df5c9216cd5148d1d001bab355f16ea6567f5fb4521f5e07bda31e8a3474783ab0ffa49a3b257ea38588adf30bd74c84b81d5fa0dbe145f65
SSDEEP

768:QKSYqu2R0GQjMKl/J6lzKt9jIyxmpO69:wYqu2R0GQYqXtF1x

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1216	1052	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4232 wrote to memory of 1052	4232	rundll32.exe	14
PID 4232 wrote to memory of 1052	4232	rundll32.exe	14
PID 4232 wrote to memory of 1052	4232	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\24c56dc4caf00a0cdf23e6472af7a287.dll,#1
1⤵
PID:1052
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1052 -s 624
  2⤵
  - Program crash
  PID:1216

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\24c56dc4caf00a0cdf23e6472af7a287.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1052 -ip 1052
1⤵
PID:1620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1052-0-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download