11fa8d4ed04b653ffb8d9f39c89a8c0498833b243e6b4fb75fd236a40077bb5e | Triage

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
27-01-2024 05:14

Sharing

Report Analysis Logs

General

Target

795c854f7e8b301d7759eb0297520f9d.dll
Size

87KB
MD5

795c854f7e8b301d7759eb0297520f9d
SHA1

90270846022eb05f01e4146e0e002d369d598c67
SHA256

11fa8d4ed04b653ffb8d9f39c89a8c0498833b243e6b4fb75fd236a40077bb5e
SHA512

1285d0f3197502fe8b6e1a6ef4f6174deb66e5f8dcd9fd99d9da7b2643f28151ee1d83411db562715f4d3fbd5970420e9cf756a0786bf42ff3a7ddbd83cda783
SSDEEP

1536:KW/QquHBbZVYFUiK97UY/DX9AHWDPjE7cWnNr:K+UbVdiKhUqtA2DjhqNr

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4436	3916	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 740 wrote to memory of 3916	740	rundll32.exe	84
PID 740 wrote to memory of 3916	740	rundll32.exe	84
PID 740 wrote to memory of 3916	740	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\795c854f7e8b301d7759eb0297520f9d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:740
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\795c854f7e8b301d7759eb0297520f9d.dll,#1
  2⤵
  PID:3916
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 548
    3⤵
    - Program crash
    PID:4436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3916 -ip 3916
1⤵
PID:3956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3916-0-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download