54f2ba03e0e341cb547e35e293ceb05c89488f8c47fa7a4e5539fcff9084b6b2 | Triage

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 04:29

Sharing

Report Analysis Logs

General

Target

uuid.dll
Size

68KB
MD5

3640ccf4bc12b2318f46266711945fe1
SHA1

fcea1ca45d2b4df21cd1f6abff315628a47f4f61
SHA256

a78cd73508a9b27b2ff4f789e14c869a3f0897c169347eedfd21b40ec40b94e9
SHA512

53bf8b24640a21897da22d0ca7641c0a794054da5a00f8eafee3875a411c5853720519bc0f0a5692d46ddf03e9f62b78223e852cbe595fc7efe1f51b029a7149
SSDEEP

1536:pHgJTXTzjkUxBc/dWQZPvtIKrD+UHEaK9ni:dgyQBc/lZPvj/GaK1i

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3008	1088	WerFault.exe	15

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 1088	2124	rundll32.exe	15
PID 2124 wrote to memory of 1088	2124	rundll32.exe	15
PID 2124 wrote to memory of 1088	2124	rundll32.exe	15
PID 2124 wrote to memory of 1088	2124	rundll32.exe	15
PID 2124 wrote to memory of 1088	2124	rundll32.exe	15
PID 2124 wrote to memory of 1088	2124	rundll32.exe	15
PID 2124 wrote to memory of 1088	2124	rundll32.exe	15
PID 1088 wrote to memory of 3008	1088	rundll32.exe	17
PID 1088 wrote to memory of 3008	1088	rundll32.exe	17
PID 1088 wrote to memory of 3008	1088	rundll32.exe	17
PID 1088 wrote to memory of 3008	1088	rundll32.exe	17

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\uuid.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\uuid.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1088
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 240
    3⤵
    - Program crash
    PID:3008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads