4e68a591b4ed8ffe693619f7d98b7af388357eaf2d8005cf15b3fb5697fe69ce | Triage

Analysis

max time kernel
91s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/01/2024, 21:41

Sharing

Report Analysis Logs

General

Target

ChatRoomUI.dll
Size

1.0MB
MD5

7e6000219e482e79fc162bab7cd90a3a
SHA1

ba280f673c87cfe62e690930e176398fad06092e
SHA256

faf1a2ecf814bf8a4a6a0651132916bd5ba383660f43139ac5c895cd62a0b963
SHA512

1d1c5bc015937068dc6b8173a83454ad8c3fd85d815e5438b5ed06cedd8142c0c701260b1d3e4001b7622aef8ed44b1f8baf765e8b238ebf7000f5546cc6f4e5
SSDEEP

12288:/EQ7Zg0u4/dH0JcQ3EyRn9WGGaMhj09kBRu2SToppDV56CuIdt32Auu9:JtgYCT3Ec9WG6Rdpdr

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1444	4292	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 4292	4512	rundll32.exe	86
PID 4512 wrote to memory of 4292	4512	rundll32.exe	86
PID 4512 wrote to memory of 4292	4512	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ChatRoomUI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ChatRoomUI.dll,#1
  2⤵
  PID:4292
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 684
    3⤵
    - Program crash
    PID:1444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4292 -ip 4292
1⤵
PID:4216

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4292-0-0x0000000000A60000-0x0000000000AA1000-memory.dmp

Filesize
260KB

Download
memory/4292-2-0x0000000000AF0000-0x0000000000B26000-memory.dmp

Filesize
216KB

Download