3743d41550e19adbb70a560058f61a199c82ce6d2ed313bd9086ac51456de9d1 | Triage

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
24/01/2024, 18:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

72c86ed80bf98a4ec34b6ab35fd96a59.dll
Size

157KB
MD5

72c86ed80bf98a4ec34b6ab35fd96a59
SHA1

7715028b58640f7e5e43ba8a240621abbffabbca
SHA256

3743d41550e19adbb70a560058f61a199c82ce6d2ed313bd9086ac51456de9d1
SHA512

6f083003356a7aa7538663b8e9e84228d3f01903ab689f301d5fcad356f046f441ba299fee32af6a9b85d8f7bede478a610c10085c8130f65eba03b5143c58dd
SSDEEP

3072:fONkyT0jEHmpRm+Hb7HHzZEvGYISwN1/cS7roXKfLo:AXYLHbrNEv1U

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4480	968	WerFault.exe	35

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 968	2384	rundll32.exe	35
PID 2384 wrote to memory of 968	2384	rundll32.exe	35
PID 2384 wrote to memory of 968	2384	rundll32.exe	35

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\72c86ed80bf98a4ec34b6ab35fd96a59.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\72c86ed80bf98a4ec34b6ab35fd96a59.dll,#1
  2⤵
  PID:968
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 968 -s 600
    3⤵
    - Program crash
    PID:4480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 968 -ip 968
1⤵
PID:4616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/968-0-0x0000000010000000-0x000000001006B000-memory.dmp

Filesize
428KB

Download