8f148084dbbe0c4fa82e318ed032667ec43638a5ca0b821e43b32f93a898dad5 | Triage

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01/01/2024, 16:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3d5ad890d8bf863fb17e0322f32c76bd.dll
Size

73KB
MD5

3d5ad890d8bf863fb17e0322f32c76bd
SHA1

41d6d34899821adbc04332b36651fa2b7a7db616
SHA256

8f148084dbbe0c4fa82e318ed032667ec43638a5ca0b821e43b32f93a898dad5
SHA512

a47ad9967d4f78bd65c37c85d5bf9a8ca918467d62f9fb818282207405e640aa4120bd4c6f1b59363fd20713d4c04dcad6abd94edbfa4693f6d394d7b13a51c9
SSDEEP

1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuv:C5UOq0ukgOK2l7aFQv

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
208	3672	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4272 wrote to memory of 3672	4272	rundll32.exe	89
PID 4272 wrote to memory of 3672	4272	rundll32.exe	89
PID 4272 wrote to memory of 3672	4272	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d5ad890d8bf863fb17e0322f32c76bd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d5ad890d8bf863fb17e0322f32c76bd.dll,#1
  2⤵
  PID:3672
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3672 -s 600
    3⤵
    - Program crash
    PID:208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3672 -ip 3672
1⤵
PID:3780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads