29666ed190a3f9f682b87e0ea324fea966d288a1a490d285fd592ee72fda03fb | Triage

Analysis

max time kernel
147s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 06:11

Sharing

Report Analysis Logs

General

Target

2b4b19f5f57d89e3040c3be7ba49b20a.dll
Size

72KB
MD5

2b4b19f5f57d89e3040c3be7ba49b20a
SHA1

d015ee177993f006d4492adc0eb1d44cd16ce6f5
SHA256

29666ed190a3f9f682b87e0ea324fea966d288a1a490d285fd592ee72fda03fb
SHA512

5e8a88caeea29e54bc1a634c5325b6177e5c866f1a2603998873bd69166feba40a8ebff629b4ac97c84ffa7082e7972c42cbe3099f694a6c8a7d9983774eed0e
SSDEEP

1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuP:C5UOq0ukgOK2l7aFQP

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2988	3572	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 3572	2984	rundll32.exe	14
PID 2984 wrote to memory of 3572	2984	rundll32.exe	14
PID 2984 wrote to memory of 3572	2984	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b4b19f5f57d89e3040c3be7ba49b20a.dll,#1
1⤵
PID:3572
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3572 -s 600
  2⤵
  - Program crash
  PID:2988

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b4b19f5f57d89e3040c3be7ba49b20a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3572 -ip 3572
1⤵
PID:4520

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads