cc6bb86138bb0e1814b6c383b0edca52d09065902c60b2df8a8871fd3af3bd67 | Triage

Analysis

max time kernel
142s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/01/2024, 14:34

Sharing

Report Analysis Logs

General

Target

56b9526addc1246700b69288b26c952f.dll
Size

130KB
MD5

56b9526addc1246700b69288b26c952f
SHA1

9a3b66c7bf25a22f2eee053950b6f371fd6ea2d5
SHA256

cc6bb86138bb0e1814b6c383b0edca52d09065902c60b2df8a8871fd3af3bd67
SHA512

2e21a274afe331a1ac3ba124b45f9544b146a4655da1c0dbef28fbb24b4aa402f60c8c5515fd153492a73710a44cff797289e6015df61be4018695368b26ecf0
SSDEEP

3072:VG+Uw6OX6PJp/f1gJCIv1NsEuQo46Xfz+QILYLm9jN:/UwTqPXuJCkhqfR4f

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1876	2924	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 2924	2564	rundll32.exe	87
PID 2564 wrote to memory of 2924	2564	rundll32.exe	87
PID 2564 wrote to memory of 2924	2564	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\56b9526addc1246700b69288b26c952f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\56b9526addc1246700b69288b26c952f.dll,#1
  2⤵
  PID:2924
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2924 -s 580
    3⤵
    - Program crash
    PID:1876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2924 -ip 2924
1⤵
PID:2036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2924-0-0x0000000010000000-0x000000001003B000-memory.dmp

Filesize
236KB

Download
memory/2924-1-0x0000000002500000-0x000000000269D000-memory.dmp

Filesize
1.6MB

Download