6cb7e7dd9bc01d70df35d02643b01d2dde01676c6147bf8f287378a252cb529d | Triage

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 15:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3a449530ad79602dd3221261166f6290.dll
Size

86KB
MD5

3a449530ad79602dd3221261166f6290
SHA1

3f88cb50e75381827658cec4fd39c6acbd6a32f4
SHA256

6cb7e7dd9bc01d70df35d02643b01d2dde01676c6147bf8f287378a252cb529d
SHA512

3af6416d43957c15bf41dc940198d299c0e9127055055458f2bde29f2e0279b8851e08796043b532de3bb39cd8d3f01c95398479797ddeaf3f34448506f31286
SSDEEP

1536:eX9QIwIyc6DqfpmMB5TYBOXGNMCHdr17unuqPuZg:kxwIj79T9UMCHd17uNWy

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1188	4540	WerFault.exe	17

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 648 wrote to memory of 4540	648	regsvr32.exe	17
PID 648 wrote to memory of 4540	648	regsvr32.exe	17
PID 648 wrote to memory of 4540	648	regsvr32.exe	17

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3a449530ad79602dd3221261166f6290.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:648
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3a449530ad79602dd3221261166f6290.dll
  2⤵
  PID:4540
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 596
    3⤵
    - Program crash
    PID:1188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4540 -ip 4540
1⤵
PID:2728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4540-0-0x00000000021E0000-0x0000000002223000-memory.dmp

Filesize
268KB

Download
memory/4540-1-0x00000000021E0000-0x0000000002223000-memory.dmp

Filesize
268KB

Download