638b0e2ffbfeabfd48e26c8db43e9b7eb1c65cf02a39608f6132f80b12388abd | Triage

Analysis

max time kernel
90s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/01/2024, 15:34

Sharing

Report Analysis Logs

General

Target

80346d2b59f81f05f11dfcb6caeb5723.dll
Size

72KB
MD5

80346d2b59f81f05f11dfcb6caeb5723
SHA1

67ec411b452f4877140e39d8e4d4d303c8416354
SHA256

638b0e2ffbfeabfd48e26c8db43e9b7eb1c65cf02a39608f6132f80b12388abd
SHA512

9c1713eedcf45702e6e4b08c061029ffb2470a3739f9a406b0915e7c16a400731650a266c47ef30cee67131d11e1c1adbaf11c9d8f9671e4e088a2351bc8c7c5
SSDEEP

1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuv:C5UOq0ukgOK2l7aFQv

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3512	3760	WerFault.exe	73

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 3760	1548	rundll32.exe	73
PID 1548 wrote to memory of 3760	1548	rundll32.exe	73
PID 1548 wrote to memory of 3760	1548	rundll32.exe	73

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\80346d2b59f81f05f11dfcb6caeb5723.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\80346d2b59f81f05f11dfcb6caeb5723.dll,#1
  2⤵
  PID:3760
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3760 -s 600
    3⤵
    - Program crash
    PID:3512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3760 -ip 3760
1⤵
PID:1424

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads