4fa76f863a451bdea9ff108fd1d9efa881451792e76f9f1ccc7ac337f826d081 | Triage

Analysis

max time kernel
140s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19-01-2024 12:24

Sharing

Report Analysis Logs

General

Target

679e768639fb38e962689edcea1a67bf.dll
Size

29KB
MD5

679e768639fb38e962689edcea1a67bf
SHA1

2ba631c8f584a619c8e54538ed837d7692fdc167
SHA256

4fa76f863a451bdea9ff108fd1d9efa881451792e76f9f1ccc7ac337f826d081
SHA512

ac10223a7dd58b393e5715318329ef2b2e67b125dc0a3c1368d573394b5d14e663ac78445c32137b8b55b8aaa5d0aa62dbba921e30b4ec3217dcf25941112806
SSDEEP

768:QP1iQgsr4+CylhT4s+elnhUWaLSeR42ZTtfXHnrhS:QP1iQBrDlUL6hO+MvHI

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4676	3268	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3464 wrote to memory of 3268	3464	rundll32.exe	85
PID 3464 wrote to memory of 3268	3464	rundll32.exe	85
PID 3464 wrote to memory of 3268	3464	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\679e768639fb38e962689edcea1a67bf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\679e768639fb38e962689edcea1a67bf.dll,#1
  2⤵
  PID:3268
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3268 -s 540
    3⤵
    - Program crash
    PID:4676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 3268 -ip 3268
1⤵
PID:3380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3268-0-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download