7d1bb3f620d658c57579f72efc8253331fda4c44019c85c8cb64fd9785d17493 | Triage

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 19:21

Sharing

Report Analysis Logs

General

Target

754eb543e77ea24efa18e835ad4bac0b.dll
Size

72KB
MD5

754eb543e77ea24efa18e835ad4bac0b
SHA1

2ff35eed3dd5a1aa27f0b160766312df1d06d03e
SHA256

7d1bb3f620d658c57579f72efc8253331fda4c44019c85c8cb64fd9785d17493
SHA512

5381847070274513730d1e81f088f06b12da3385b8ccd7849fcb65cc01086e51a3b2ac3b5bf7f7371b3f08b0a3c3cf631bf1a58583bdb4c625195110931fd860
SSDEEP

1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuv:C5UOq0ukgOK2l7aFQv

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2324	3440	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3084 wrote to memory of 3440	3084	rundll32.exe	85
PID 3084 wrote to memory of 3440	3084	rundll32.exe	85
PID 3084 wrote to memory of 3440	3084	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\754eb543e77ea24efa18e835ad4bac0b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3084
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\754eb543e77ea24efa18e835ad4bac0b.dll,#1
  2⤵
  PID:3440
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 600
    3⤵
    - Program crash
    PID:2324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3440 -ip 3440
1⤵
PID:3100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads