aa912b656aeb0bfddea1e01d68fb040c90ca01232c5a0650b73f6ae615377f74 | Triage

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
07-01-2024 13:44

Sharing

Report Analysis Logs

General

Target

4921eaa712f340b0a9ab3344505388c9.dll
Size

241KB
MD5

4921eaa712f340b0a9ab3344505388c9
SHA1

4539cc7c8369475e22e181b778ee141ffeb4e3e9
SHA256

aa912b656aeb0bfddea1e01d68fb040c90ca01232c5a0650b73f6ae615377f74
SHA512

bd2180721cf66f34165d667e7f455349163d0b7d0db09dafb67f0232c4861239b63048c1d05d30153fd3742c5a17a7dfe6059b5b5290d97fd31b0fb0cb02c7d9
SSDEEP

6144:oqTrecAn327nq5Ka+WmbV7I+Caq7HMCtJXPpg:oqeDGO5KmmJ9bkMCtJXRg

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3184	3584	WerFault.exe	67

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 3584	4772	rundll32.exe	67
PID 4772 wrote to memory of 3584	4772	rundll32.exe	67
PID 4772 wrote to memory of 3584	4772	rundll32.exe	67

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4921eaa712f340b0a9ab3344505388c9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4921eaa712f340b0a9ab3344505388c9.dll,#1
  2⤵
  PID:3584
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3584 -s 624
    3⤵
    - Program crash
    PID:3184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3584 -ip 3584
1⤵
PID:1380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3584-0-0x0000000002190000-0x000000000225A000-memory.dmp

Filesize
808KB

Download
memory/3584-1-0x0000000002190000-0x000000000225A000-memory.dmp

Filesize
808KB

Download
memory/3584-2-0x0000000002190000-0x000000000225A000-memory.dmp

Filesize
808KB

Download
memory/3584-3-0x0000000002190000-0x000000000225A000-memory.dmp

Filesize
808KB

Download