f342e09517abc0b53d1db9831dbd4551d68ac7a6f9db48bd0acee919e6d21275 | Triage

Analysis

max time kernel
90s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/01/2024, 07:56

Sharing

Report Analysis Logs

General

Target

libfontconfig-1.dll
Size

137KB
MD5

29dd0774a7a09f1e3d4614df389faa52
SHA1

77745db0a1f84525d5bb82830b7accf01951ec27
SHA256

233284aaf4e6dd17998ab4cf55511052d891609ee74f26b3edcc9424c6a0c6fe
SHA512

7c95a06bbf3a5b31953271f4ba45160266d29155e926c0d13bf794dafcfcaba654449dccf4d1455170429c07ef3efbfb1ce2af642a9dfe9026d29b2a2fcb8390
SSDEEP

3072:BG5PtVLeyAuAEaIdM0IB0spcY3FdzNnf18PuB:BSPtt1xs0IiXY3FdxfqS

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3716	208	WerFault.exe	18

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3228 wrote to memory of 208	3228	rundll32.exe	18
PID 3228 wrote to memory of 208	3228	rundll32.exe	18
PID 3228 wrote to memory of 208	3228	rundll32.exe	18

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libfontconfig-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3228
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libfontconfig-1.dll,#1
  2⤵
  PID:208
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 604
    3⤵
    - Program crash
    PID:3716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 208 -ip 208
1⤵
PID:2184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/208-2-0x0000000067C40000-0x0000000067C62000-memory.dmp

Filesize
136KB

Download
memory/208-1-0x000000006AAC0000-0x000000006AB22000-memory.dmp

Filesize
392KB

Download
memory/208-0-0x0000000063C80000-0x0000000063CA8000-memory.dmp

Filesize
160KB

Download