f342e09517abc0b53d1db9831dbd4551d68ac7a6f9db48bd0acee919e6d21275 | Triage

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
29/01/2024, 07:56

Sharing

Report Analysis Logs

General

Target

libnetsnmp-15.dll
Size

228KB
MD5

fecda5c5b51a40a259e774d745c8ffc3
SHA1

571c291d3be4eb98e38bb3b4f882199b2e6e6376
SHA256

80c185e17dad493899fc892c41078c5637d3ef8df951dfe99cf6062483393d67
SHA512

7f05134db8905dd0d5ac1fda1af2964e882d25de8ae3ad2ca5a998590caf6b10bcb905c1a84d4d8c9f57760cbfcd1ee32cea64c38a831cdd0347258eea7d8143
SSDEEP

6144:Q76IRikAcLVvwrZNDOztjSoAVLKEml0DSA:nItfLvNStNgl0DS

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4460	2980	WerFault.exe	19

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 2980	1220	rundll32.exe	19
PID 1220 wrote to memory of 2980	1220	rundll32.exe	19
PID 1220 wrote to memory of 2980	1220	rundll32.exe	19

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libnetsnmp-15.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libnetsnmp-15.dll,#1
  2⤵
  PID:2980
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 632
    3⤵
    - Program crash
    PID:4460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2980 -ip 2980
1⤵
PID:4216

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2980-0-0x000000006BE40000-0x000000006BE9E000-memory.dmp

Filesize
376KB

Download