f07bf397abd8b6bed01b838c3f332319c997f810ee5ec5087e761f1ccc39641a | Triage

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
14-01-2024 01:15

Sharing

Report Analysis Logs

General

Target

concrt140.dll
Size

7.3MB
MD5

66e4d1076963f85b9ce83b2c5de45543
SHA1

bdb2a7b5e3e151839652d6fe18a76832aecea0a5
SHA256

fbc4074ffc36cbb2e4d23200d5b91d2fedc4c037dfcae21ce6e5c54d2295ceb7
SHA512

5b3ec6ed13ed1e3aaa22223f6440621e7a5ba906a4d6b933f1cee96bee33ad2ab80fa45de11f809b1e3721049c6bcab117ad8d1835d8588113c34ad4a363bddb
SSDEEP

49152:5eA/z2/jH2mnqxjsMYP9TQgNgokTKWcnMNWz/6UGM+4+eXGIWh4uw4y4q7WkXc8W:Ig

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1980	3856	WerFault.exe	22

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3856	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 3856	2064	rundll32.exe	22
PID 2064 wrote to memory of 3856	2064	rundll32.exe	22
PID 2064 wrote to memory of 3856	2064	rundll32.exe	22

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\concrt140.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\concrt140.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3856
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 604
    3⤵
    - Program crash
    PID:1980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3856 -ip 3856
1⤵
PID:1884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads