41c2018ce20b89450e721490ead156e4a434254930c046eb10a4bbc45e0bd752 | Triage

Analysis

max time kernel
129s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 19:24

Sharing

Report Analysis Logs

General

Target

75507047e5a24edae825390a8b2f3135.dll
Size

64KB
MD5

75507047e5a24edae825390a8b2f3135
SHA1

4f8e089f84e765a942818b65afa6ec410621f8a4
SHA256

41c2018ce20b89450e721490ead156e4a434254930c046eb10a4bbc45e0bd752
SHA512

1e665c7f51c4309f96b756e51a5f2f9cbabf07a58da765d00cb2e3b3de41f53d2d919aaf815a5d831cc04e807e095fe1c9be0cf4f8773d3a925c1608b1034ec1
SSDEEP

1536:3pHgXUao7fZ/EyVJgaFVBydpTUpPjadBB:5AXUaq5EyzgarByjwpPjadB

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4168	1016	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 1016	2200	rundll32.exe	87
PID 2200 wrote to memory of 1016	2200	rundll32.exe	87
PID 2200 wrote to memory of 1016	2200	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\75507047e5a24edae825390a8b2f3135.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\75507047e5a24edae825390a8b2f3135.dll,#1
  2⤵
  PID:1016
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1016 -s 604
    3⤵
    - Program crash
    PID:4168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1016 -ip 1016
1⤵
PID:4556

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1016-1-0x00000000014D0000-0x00000000014DC000-memory.dmp

Filesize
48KB

Download
memory/1016-0-0x0000000010000000-0x0000000010033000-memory.dmp

Filesize
204KB

Download
memory/1016-2-0x00000000014D0000-0x00000000014DC000-memory.dmp

Filesize
48KB

Download