4e68a591b4ed8ffe693619f7d98b7af388357eaf2d8005cf15b3fb5697fe69ce | Triage

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/01/2024, 21:41

Sharing

Report Analysis Logs

General

Target

ChatRoomUI.dll
Size

1.0MB
MD5

7e6000219e482e79fc162bab7cd90a3a
SHA1

ba280f673c87cfe62e690930e176398fad06092e
SHA256

faf1a2ecf814bf8a4a6a0651132916bd5ba383660f43139ac5c895cd62a0b963
SHA512

1d1c5bc015937068dc6b8173a83454ad8c3fd85d815e5438b5ed06cedd8142c0c701260b1d3e4001b7622aef8ed44b1f8baf765e8b238ebf7000f5546cc6f4e5
SSDEEP

12288:/EQ7Zg0u4/dH0JcQ3EyRn9WGGaMhj09kBRu2SToppDV56CuIdt32Auu9:JtgYCT3Ec9WG6Rdpdr

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1460	2456	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2456	2264	rundll32.exe	28
PID 2264 wrote to memory of 2456	2264	rundll32.exe	28
PID 2264 wrote to memory of 2456	2264	rundll32.exe	28
PID 2264 wrote to memory of 2456	2264	rundll32.exe	28
PID 2264 wrote to memory of 2456	2264	rundll32.exe	28
PID 2264 wrote to memory of 2456	2264	rundll32.exe	28
PID 2264 wrote to memory of 2456	2264	rundll32.exe	28
PID 2456 wrote to memory of 1460	2456	rundll32.exe	29
PID 2456 wrote to memory of 1460	2456	rundll32.exe	29
PID 2456 wrote to memory of 1460	2456	rundll32.exe	29
PID 2456 wrote to memory of 1460	2456	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ChatRoomUI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ChatRoomUI.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2456
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 268
    3⤵
    - Program crash
    PID:1460

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2456-0-0x00000000006C0000-0x0000000000701000-memory.dmp

Filesize
260KB

Download
memory/2456-2-0x0000000000720000-0x0000000000756000-memory.dmp

Filesize
216KB

Download