f342e09517abc0b53d1db9831dbd4551d68ac7a6f9db48bd0acee919e6d21275 | Triage

Analysis

max time kernel
141s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/01/2024, 07:56

Sharing

Report Analysis Logs

General

Target

libgio-2.0-0.dll
Size

230KB
MD5

c8c1b669e8c22a14fd3635585ecd6e76
SHA1

6f1caed610d380a49c5220597761b3c0e47917df
SHA256

b4aa4b8d8c114dcba1433bdce5b1ac6cd029cf9eff0912f9364d21c068fafb93
SHA512

eca34e1d50a47407bc4b6ae62568059b9f8ecf9a69553f0c78a0daffbfd2fc9dbcae09e2e5a4cd2d8482dec43a912b2113e7c4085f543ba2727d9bb279b6acc7
SSDEEP

3072:ZYg6mllS00T8Pcv6qIXy9h6qF3HKxjcN0AB8cKrGtsSyl3+iYv:eg6mllIRcXyPDqyN0AB8cKStsSOO

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4792	4352	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3676 wrote to memory of 4352	3676	rundll32.exe	82
PID 3676 wrote to memory of 4352	3676	rundll32.exe	82
PID 3676 wrote to memory of 4352	3676	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libgio-2.0-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3676
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libgio-2.0-0.dll,#1
  2⤵
  PID:4352
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 644
    3⤵
    - Program crash
    PID:4792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4352 -ip 4352
1⤵
PID:2092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4352-0-0x000000006C280000-0x000000006C2C1000-memory.dmp

Filesize
260KB

Download
memory/4352-2-0x000000006CA00000-0x000000006CA0D000-memory.dmp

Filesize
52KB

Download
memory/4352-1-0x00000000672C0000-0x0000000067377000-memory.dmp

Filesize
732KB

Download
memory/4352-3-0x0000000062740000-0x0000000062775000-memory.dmp

Filesize
212KB

Download