7080569c73fa17f5d348110a93668f1e9733cd943464b1be907a395cebbd3b50 | Triage

Analysis

max time kernel
135s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
05/01/2024, 14:31

Sharing

Report Analysis Logs

General

Target

43ec3c62be835118a6bf4fa3190dc040.dll
Size

841KB
MD5

43ec3c62be835118a6bf4fa3190dc040
SHA1

094faa64b7179c7454a9b9f54325e98c4cac4479
SHA256

7080569c73fa17f5d348110a93668f1e9733cd943464b1be907a395cebbd3b50
SHA512

fb0463a18fd63117aa049ad1c78a7369d2c1263f233d54389346033a677422d6b12ee069cdf61e1fdfa96086e9782746117c99fb37930384d53d0967ebd7114e
SSDEEP

24576:LPIA0kWSWWIYvs5gkbWmQJhFoqZ7FbLaVwes:yyhFoqHWs

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4556	1984	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3456 wrote to memory of 1984	3456	rundll32.exe	89
PID 3456 wrote to memory of 1984	3456	rundll32.exe	89
PID 3456 wrote to memory of 1984	3456	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\43ec3c62be835118a6bf4fa3190dc040.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3456
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\43ec3c62be835118a6bf4fa3190dc040.dll,#1
  2⤵
  PID:1984
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 680
    3⤵
    - Program crash
    PID:4556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1984 -ip 1984
1⤵
PID:688

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1984-0-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download