db063e1db8848a6186721331ae76e07f1615856345dec12b08a2b215ac5bb29b | Triage

Analysis

max time kernel
150s
max time network
196s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/01/2024, 01:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

concrt140.dll
Size

2.3MB
MD5

ab626dd445d8cba4713f0bf29c307418
SHA1

bae8c51bb9b30e9d73c16beba92924fe290f9a5d
SHA256

690c67fe8d5c6a6c3f1f72e05214e674a876ed865db14bb34f9b39cff21f7645
SHA512

190c8b5b068a367c58dc47982542213eebbdeb49280b50d49d238dbec494ad214418ad19af5e6b6d1db44acfd38ab704fa01465de529074d4e7caf305d7bce3b
SSDEEP

12288:z+CpeAUpXuu/KzYw6ItOCikMwxv5sF10UOOSuHLtz/RZQ9ZfeUnrQnqOQ0W4cm6T:z+CpeAUpLyzYmget

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4316	1396	WerFault.exe	17

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1396	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3400 wrote to memory of 1396	3400	rundll32.exe	17
PID 3400 wrote to memory of 1396	3400	rundll32.exe	17
PID 3400 wrote to memory of 1396	3400	rundll32.exe	17

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\concrt140.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3400
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\concrt140.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1396
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 604
    3⤵
    - Program crash
    PID:4316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1396 -ip 1396
1⤵
PID:3152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads