8fb3dc9dbc95b7854eb91fa165d7fd36361df9f62bbdf1715b6f606b8f48c14e | Triage

Analysis

max time kernel
137s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 17:57

Sharing

Report Analysis Logs

General

Target

7526b01861f357360f6891b6a7ec1b5c.dll
Size

73KB
MD5

7526b01861f357360f6891b6a7ec1b5c
SHA1

9d5ca04413be1ff0b5b88a23a6a6ef93e8abd69e
SHA256

8fb3dc9dbc95b7854eb91fa165d7fd36361df9f62bbdf1715b6f606b8f48c14e
SHA512

51de67378f2ce5fe0ab0ae9cdbbaa00723aa9dd078b601af1293a6c9c5b21b55b0a76f622efee9ad1909798d03b9116eb4e8e38273649262d31f559a7dca30cf
SSDEEP

1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuv:C5UOq0ukgOK2l7aFQv

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4908	4652	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 4652	1732	rundll32.exe	86
PID 1732 wrote to memory of 4652	1732	rundll32.exe	86
PID 1732 wrote to memory of 4652	1732	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7526b01861f357360f6891b6a7ec1b5c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7526b01861f357360f6891b6a7ec1b5c.dll,#1
  2⤵
  PID:4652
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4652 -s 600
    3⤵
    - Program crash
    PID:4908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4652 -ip 4652
1⤵
PID:1912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads