02ee8e32c4184b129f3ada79c9779d313644dea054177537d798c353335e1d5e | Triage

Analysis

max time kernel
91s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
26-01-2024 01:56

Sharing

Report Analysis Logs

General

Target

7615c75eb65f4433bf2105fa522ddef1.dll
Size

99KB
MD5

7615c75eb65f4433bf2105fa522ddef1
SHA1

7506be44b729de9ec33bca77d7965e43079d75a2
SHA256

02ee8e32c4184b129f3ada79c9779d313644dea054177537d798c353335e1d5e
SHA512

55aa77a0a9a1b4b1d5c34e5d0547dd801e2aff6b5c0d03d098ec79e129f2cd2f3f98b77e61c80d21ce10f70f72072750f648c7ab4b4a7d33cc55b3b92574a0b3
SSDEEP

3072:avpOsLQGljuazw8IjhVSUOGsR6Ci2jHJM:psLQGljuKUjLBOGsgCi2D

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1620	2472	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 2472	1528	rundll32.exe	84
PID 1528 wrote to memory of 2472	1528	rundll32.exe	84
PID 1528 wrote to memory of 2472	1528	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7615c75eb65f4433bf2105fa522ddef1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7615c75eb65f4433bf2105fa522ddef1.dll,#1
  2⤵
  PID:2472
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2472 -s 660
    3⤵
    - Program crash
    PID:1620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2472 -ip 2472
1⤵
PID:1116

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads