b56b2e88ed056a6fe257838c691ed43bc6dd08fd8edc5884b0c515926f5ed00c | Triage

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
06/01/2024, 18:26

Sharing

Report Analysis Logs

General

Target

46e62f9367d5027c29ee93e28fa85bf8.dll
Size

158KB
MD5

46e62f9367d5027c29ee93e28fa85bf8
SHA1

26a6e38a1a3937317d34a5a4147899fdc7395269
SHA256

b56b2e88ed056a6fe257838c691ed43bc6dd08fd8edc5884b0c515926f5ed00c
SHA512

24e5b0f9f986c49a55bdc3af6cea26e646ef53c3ea8376b2e9b63f2e507995a08b2bf946203683e095994c6a83a05d21f0d28914531f8c9a1ea8df8159f0e4db
SSDEEP

3072:tRSJNcL/yvKEszUbt//B8xd9SQ7ykDASIG4:eDcLaYa//B6AQe8

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2160	1384	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 1384	1648	regsvr32.exe	88
PID 1648 wrote to memory of 1384	1648	regsvr32.exe	88
PID 1648 wrote to memory of 1384	1648	regsvr32.exe	88

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\46e62f9367d5027c29ee93e28fa85bf8.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\46e62f9367d5027c29ee93e28fa85bf8.dll
  2⤵
  PID:1384
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 604
    3⤵
    - Program crash
    PID:2160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1384 -ip 1384
1⤵
PID:4596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1384-0-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download