0da567c2ba018ae2f40b40dc1f48254898bde8689f464b04026c1391d63b9492 | Triage

Analysis

max time kernel
126s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2023 07:21

Sharing

Report Analysis Logs

General

Target

2d31ed7ffceeaf0c483ff745bedaffa7.dll
Size

72KB
MD5

2d31ed7ffceeaf0c483ff745bedaffa7
SHA1

d6dd526717776bde538d40337b3942a57ad6c410
SHA256

0da567c2ba018ae2f40b40dc1f48254898bde8689f464b04026c1391d63b9492
SHA512

bbe1b3d049baee305282d8745b3228763e8b0bc9d4d00d133ae91d5f4fc5dc4cfb9d1f28260e7cf7120e83e535583c59286819ba3188e97a552824d7272e6913
SSDEEP

1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuv:C5UOq0ukgOK2l7aFQv

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
464	1508	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3296 wrote to memory of 1508	3296	rundll32.exe	14
PID 3296 wrote to memory of 1508	3296	rundll32.exe	14
PID 3296 wrote to memory of 1508	3296	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d31ed7ffceeaf0c483ff745bedaffa7.dll,#1
1⤵
PID:1508
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 608
  2⤵
  - Program crash
  PID:464

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d31ed7ffceeaf0c483ff745bedaffa7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1508 -ip 1508
1⤵
PID:3008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads