1b6199a0b154ad01b3310911353ca152863f35c853eaaedf0cf67c75582c29d7 | Triage

Analysis

max time kernel
152s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/01/2024, 11:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

564d351f40d9c9b5c25a6561024fc7af.dll
Size

525KB
MD5

564d351f40d9c9b5c25a6561024fc7af
SHA1

8947daccdf28da05b56b3a6b87fe5e19d867bdfe
SHA256

1b6199a0b154ad01b3310911353ca152863f35c853eaaedf0cf67c75582c29d7
SHA512

1b7fab0de185c67de7c416435aae9d1a8da2fbbe0b3cf1b6c13df3a8aca7dece627587783dae1c17f381e266512a413af8514c03735e5d5ba77ceee5a7583bfb
SSDEEP

12288:RJFtyyPBEmdnAGmJ9dFUBHepOIOeQ2cTgYU:R71EaXmFFQewIOUcTD

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1104	3528	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3492 wrote to memory of 3528	3492	rundll32.exe	90
PID 3492 wrote to memory of 3528	3492	rundll32.exe	90
PID 3492 wrote to memory of 3528	3492	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\564d351f40d9c9b5c25a6561024fc7af.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3492
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\564d351f40d9c9b5c25a6561024fc7af.dll,#1
  2⤵
  PID:3528
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3528 -s 640
    3⤵
    - Program crash
    PID:1104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3528 -ip 3528
1⤵
PID:4352

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads