e7e50678a688b5a7bd3b76ca1e948809590ebff535881f9d245dafbfb8b3dc11 | Triage

Analysis

max time kernel
142s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
08/01/2024, 13:44

Sharing

Report Analysis Logs

General

Target

atrc.dll
Size

76KB
MD5

143c1b061c29e8e6da3223591561837d
SHA1

e7542e2668e69ef8f159a7f2e7207d7552b4fb74
SHA256

98bc8d1425b7e2ae944074cab85f1b75ac86f4243420e088e0f1685009107a8f
SHA512

df8299935f8401368af7606a544213fd0662c67aed6819d0ee29e9266fc51349b08990fbf5a1a7a95eb09ad73173123b31d0f0bcacae852640adf5934451497e
SSDEEP

1536:yiIYskdn7pp5XIHvU/zTnw/unZ+NQvExk:DInap5XOU/vAIZpvEO

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
964	4772	WerFault.exe	12

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3264 wrote to memory of 4772	3264	rundll32.exe	12
PID 3264 wrote to memory of 4772	3264	rundll32.exe	12
PID 3264 wrote to memory of 4772	3264	rundll32.exe	12

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\atrc.dll,#1
1⤵
PID:4772
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 608
  2⤵
  - Program crash
  PID:964

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\atrc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4772 -ip 4772
1⤵
PID:4264

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads