e355e4d9fbfc4d275b988903ca4f3866693ebd75f7c2abfee539f0a03b0a3a43 | Triage

Analysis

max time kernel
141s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24-01-2024 21:54

Sharing

Report Analysis Logs

General

Target

72f2372e63c0e6b9f86c169b24e7dfe4.dll
Size

29KB
MD5

72f2372e63c0e6b9f86c169b24e7dfe4
SHA1

d8f6e5c226709d55638319f91ccf94879aabe2a6
SHA256

e355e4d9fbfc4d275b988903ca4f3866693ebd75f7c2abfee539f0a03b0a3a43
SHA512

08fdc0da34c0ee92dcc99f885906036830444ee1e2a75acebf7d87932f58e3d37bb48882422f8707b68c6492779119ef7e050ee2dea21b3130ab68836b05119c
SSDEEP

768:1aH4jqKKIO/I7CEews63LeQ4Gfler1PUd/RAaB:1EK9O/I5ei3qtGfoBUd

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1852	4140	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 4140	5088	rundll32.exe	85
PID 5088 wrote to memory of 4140	5088	rundll32.exe	85
PID 5088 wrote to memory of 4140	5088	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\72f2372e63c0e6b9f86c169b24e7dfe4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\72f2372e63c0e6b9f86c169b24e7dfe4.dll,#1
  2⤵
  PID:4140
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 548
    3⤵
    - Program crash
    PID:1852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4140 -ip 4140
1⤵
PID:1936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4140-0-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download