0efb1db102634ace93f77fedd45a6da7f8cb582882f5d7cd88c5ca04660687bf | Triage

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 05:12

Sharing

Report Analysis Logs

General

Target

2984d50754f3f00bfa3cbcc855e11d18.dll
Size

91KB
MD5

2984d50754f3f00bfa3cbcc855e11d18
SHA1

74f90d3df26cebce914d9e2d3187902b6c77e9f9
SHA256

0efb1db102634ace93f77fedd45a6da7f8cb582882f5d7cd88c5ca04660687bf
SHA512

6714b42aabf0454e442b881f0b3122d6bab4b1e8b5866ed188be023df243b92e4b5d3ff5ac179b41b2f2467fdbe26b6776dbe30d416fe5df063b0c2a3c3756b6
SSDEEP

1536:WsMwhk7sW8+beD1/M9S8N8b8w2p5NKaCg:Wrpu0Yy6ww2p5Nag

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2988	3812	WerFault.exe	16

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 3812	4816	rundll32.exe	16
PID 4816 wrote to memory of 3812	4816	rundll32.exe	16
PID 4816 wrote to memory of 3812	4816	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2984d50754f3f00bfa3cbcc855e11d18.dll,#1
1⤵
PID:3812
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3812 -s 628
  2⤵
  - Program crash
  PID:2988

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2984d50754f3f00bfa3cbcc855e11d18.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3812 -ip 3812
1⤵
PID:4168

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads