20d91430397028cb83296e7a41598414c9a4ef272afba435196d231a8cbd0b67 | Triage

Analysis

max time kernel
118s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18-01-2024 03:51

Sharing

Report Analysis Logs

General

Target

api-ms-win-core-file-l1-1-0.dll
Size

21KB
MD5

4215700161720c767e725b1f7fc358ab
SHA1

6e31fa39775c1c6c60fe8869761c31148b0a8019
SHA256

38e535e9a79cd72e3f5e3c0ec9c97a18e86d480a504ea6c85854a6f70b302c3a
SHA512

8c93f4021544ffafa37665efcbfa2c4d23742573e695766c637c9449a39af5ea0de114c821a5c50b886ed1ab0f0a2be0fdda164884d73f7488402cfa2137e5b6
SSDEEP

384:HBPvVXWWfhWkQ7q0GftpBjNhZjl78oS/i:hPvVX3Oi9Laa

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 2748	3040	rundll32.exe	28
PID 3040 wrote to memory of 2748	3040	rundll32.exe	28
PID 3040 wrote to memory of 2748	3040	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\api-ms-win-core-file-l1-1-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3040 -s 84
  2⤵
  PID:2748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads