26f577e37ae6ea65acf5f454c439fd7adcd0491380bdc683ae84d34e654ea9b9 | Triage

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 01:14

Sharing

Report Analysis Logs

General

Target

InfoReport.dll
Size

672KB
MD5

0276c3432619026fe404c8992f069a4f
SHA1

0f12c111c55a417c6760b672c9822f3332a8ed09
SHA256

f5bc9732722f9f3bcb93c75cfa64d231d48ad41cb1cafcb7a3666a7c3e6fa6ae
SHA512

13d966b9a645c6cb2a650faaef4926be3b95f47cde70a20c447acf7304c2eea8d80a090ad913ce8585c0e87903f42f65b7dee58cc0cf548173c5f01474639f69
SSDEEP

12288:2SIKJBPe8CTYQNRpomG8ZUfac1HdfBdohOxLlCQ2tlr3d+6WA:2SDBPe8AxPpVG8W9f44xJ2z3d7

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1052	1276	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 1276	2644	rundll32.exe	28
PID 2644 wrote to memory of 1276	2644	rundll32.exe	28
PID 2644 wrote to memory of 1276	2644	rundll32.exe	28
PID 2644 wrote to memory of 1276	2644	rundll32.exe	28
PID 2644 wrote to memory of 1276	2644	rundll32.exe	28
PID 2644 wrote to memory of 1276	2644	rundll32.exe	28
PID 2644 wrote to memory of 1276	2644	rundll32.exe	28
PID 1276 wrote to memory of 1052	1276	rundll32.exe	29
PID 1276 wrote to memory of 1052	1276	rundll32.exe	29
PID 1276 wrote to memory of 1052	1276	rundll32.exe	29
PID 1276 wrote to memory of 1052	1276	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\InfoReport.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\InfoReport.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1276
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1276 -s 248
    3⤵
    - Program crash
    PID:1052

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1276-0-0x0000000010000000-0x00000000100EB000-memory.dmp

Filesize
940KB

Download