030f4ed628f2d3913cb5712dc8aa269af25364e4804bc47b9e0a93d730f27a72 | Triage

Analysis

max time kernel
89s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
28/01/2024, 11:44

Sharing

Report Analysis Logs

General

Target

7d083e650d26cb2965226ffc44073c76.dll
Size

948KB
MD5

7d083e650d26cb2965226ffc44073c76
SHA1

1d6bc3511742ab827d96739165e0679101b3e22e
SHA256

030f4ed628f2d3913cb5712dc8aa269af25364e4804bc47b9e0a93d730f27a72
SHA512

c419f99bf57c0b171480533ea2e3d23a18735481cacab63832031ec768668141db01d3c9a7926b53bb61815a73893978ab98407290f835fb46358c76b1009894
SSDEEP

24576:nf+ZdEnoqripmcvel0w3B5sLmkjWa/lXl:fkzq+4N3BMNj11

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1968	4112	WerFault.exe	20

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 4112	2876	rundll32.exe	20
PID 2876 wrote to memory of 4112	2876	rundll32.exe	20
PID 2876 wrote to memory of 4112	2876	rundll32.exe	20

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7d083e650d26cb2965226ffc44073c76.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7d083e650d26cb2965226ffc44073c76.dll,#1
  2⤵
  PID:4112
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4112 -s 564
    3⤵
    - Program crash
    PID:1968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4112 -ip 4112
1⤵
PID:2692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads