879d19a5181d81a1747ea49b42d4c24549fa59c9932b9ac18dbf67eba6815810 | Triage

Analysis

max time kernel
93s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2024 19:14

Sharing

Report Analysis Logs

General

Target

754be748c97ab6e5731c0dc7b7a584da.dll
Size

402KB
MD5

754be748c97ab6e5731c0dc7b7a584da
SHA1

c8d3a8fb39e16d268c157a75c270b400cc149922
SHA256

879d19a5181d81a1747ea49b42d4c24549fa59c9932b9ac18dbf67eba6815810
SHA512

607d0e568f910166027d9a61b5e6ec5d711aa442147f52372a89c1bbe9de1641c50fa08a5800bbdd5faf5a8876575b610518e4870ca5ad7a58eb0b169cd3be28
SSDEEP

12288:NYV+inLjCMuAZaqwQuB5+xr1hyC3vZUwOge+k:IfL7uAZdwer1YChUbn+k

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4596	3420	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 3420	2664	rundll32.exe	85
PID 2664 wrote to memory of 3420	2664	rundll32.exe	85
PID 2664 wrote to memory of 3420	2664	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\754be748c97ab6e5731c0dc7b7a584da.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\754be748c97ab6e5731c0dc7b7a584da.dll,#1
  2⤵
  PID:3420
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3420 -s 844
    3⤵
    - Program crash
    PID:4596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3420 -ip 3420
1⤵
PID:4888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads