24304657e1d80e1c6d07dd4d4b0afd62ef638a905de507c17715c7db949931f9 | Triage

Analysis

max time kernel
146s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
07/01/2024, 02:01

Sharing

Report Analysis Logs

General

Target

47bc9c23b9911995d3b8ca87d5138e23.dll
Size

72KB
MD5

47bc9c23b9911995d3b8ca87d5138e23
SHA1

7855274c79526317e5385524cfc9239a863540ef
SHA256

24304657e1d80e1c6d07dd4d4b0afd62ef638a905de507c17715c7db949931f9
SHA512

79b5281cf70930687468e616a3ba768df2cc2161f2e61209ccc33b2fc3f8de779f380799ec7dada05dc04b5cbea8e63cdbc08695889848bf3b801c4a99e0e561
SSDEEP

1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuv:C5UOq0ukgOK2l7aFQv

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2212	5044	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 5044	3032	rundll32.exe	86
PID 3032 wrote to memory of 5044	3032	rundll32.exe	86
PID 3032 wrote to memory of 5044	3032	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\47bc9c23b9911995d3b8ca87d5138e23.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\47bc9c23b9911995d3b8ca87d5138e23.dll,#1
  2⤵
  PID:5044
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 604
    3⤵
    - Program crash
    PID:2212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5044 -ip 5044
1⤵
PID:1476

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads