fd9b417e6a47214c63afcbfcc53a6771685f42119ceb1e95205f34edf0eca5d5 | Triage

Analysis

max time kernel
113s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
03/01/2024, 21:37

Sharing

Report Analysis Logs

General

Target

3f16281c715dc654b4bc0852cffa1fc7.dll
Size

174KB
MD5

3f16281c715dc654b4bc0852cffa1fc7
SHA1

19627a11a7af0ec7e94c5e7090d935e26f0d24fa
SHA256

fd9b417e6a47214c63afcbfcc53a6771685f42119ceb1e95205f34edf0eca5d5
SHA512

dc7b1c417eade3fa1e55efa9963c8310dc9e9a04d47f4de98b2f7307e04f3e87f14ee109e51778ff535ff776e87ee6b8b0523387a25737f1ab45d0ef0ba19523
SSDEEP

3072:CqIQ7kpK6xN4aN2JfaRRwuypMA642dyKIh2iu2Ng/Zz:bIQ52uMGqZ+64TQ2g

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1072	1492	WerFault.exe	16

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 1492	1508	rundll32.exe	16
PID 1508 wrote to memory of 1492	1508	rundll32.exe	16
PID 1508 wrote to memory of 1492	1508	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f16281c715dc654b4bc0852cffa1fc7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3f16281c715dc654b4bc0852cffa1fc7.dll,#1
  2⤵
  PID:1492
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 656
    3⤵
    - Program crash
    PID:1072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1492 -ip 1492
1⤵
PID:348

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1492-0-0x0000000000CA0000-0x0000000000CCD000-memory.dmp

Filesize
180KB

Download