79363059a6975e6cdebca0536e6394220649911f13adb2a9b359eb6d9ec5fdd7 | Triage

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 18:57

Sharing

Report Analysis Logs

General

Target

3accb31a205d729d33c9e957e1657ad8.dll
Size

28KB
MD5

3accb31a205d729d33c9e957e1657ad8
SHA1

60ba2714299aa8c8208ad40f6698b8eed9d49174
SHA256

79363059a6975e6cdebca0536e6394220649911f13adb2a9b359eb6d9ec5fdd7
SHA512

c2146060c5ae390fe8e828636e9e1f622de2f2d72ffe5fd348102542a93f7e387cfdbdcf61b4a6a875e5b13b2b9aa84f026622019ee7416e27b854c8882f13b5
SSDEEP

768:ddW6junwdlw/8yHHph1J/+XFi2Evx2hVs/86i:dd9j1dl/4f1J/72EvxgQ8X

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3924	1648	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 1648	2684	rundll32.exe	14
PID 2684 wrote to memory of 1648	2684	rundll32.exe	14
PID 2684 wrote to memory of 1648	2684	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3accb31a205d729d33c9e957e1657ad8.dll,#1
1⤵
PID:1648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 544
  2⤵
  - Program crash
  PID:3924

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3accb31a205d729d33c9e957e1657ad8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1648 -ip 1648
1⤵
PID:4640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1648-0-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download