fbdd5b5c8cf9c90ea77778be587f854a9d258872306c075bc7d39709329a0932 | Triage

Analysis

max time kernel
158s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
07/01/2024, 13:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

491f15ecc254100275ccfb88c5dca40e.dll
Size

72KB
MD5

491f15ecc254100275ccfb88c5dca40e
SHA1

fcaa25287622cd50367d9f1ee8b304011dd2306d
SHA256

fbdd5b5c8cf9c90ea77778be587f854a9d258872306c075bc7d39709329a0932
SHA512

c9d70cc14c2319f12c200d1d005b4c6c08de288ba04c5f337642182ed17ba1dc5036cb93a9fc1fa9dac1b4f3bc273c8ea2fd196773c5a93e2d44a0c862e05c49
SSDEEP

1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuv:C5UOq0ukgOK2l7aFQv

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1364	1948	WerFault.exe	59

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4112 wrote to memory of 1948	4112	rundll32.exe	59
PID 4112 wrote to memory of 1948	4112	rundll32.exe	59
PID 4112 wrote to memory of 1948	4112	rundll32.exe	59

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\491f15ecc254100275ccfb88c5dca40e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\491f15ecc254100275ccfb88c5dca40e.dll,#1
  2⤵
  PID:1948
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 600
    3⤵
    - Program crash
    PID:1364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1948 -ip 1948
1⤵
PID:3788

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads