da51aca27777c2fd13be2e099f6657b7815633bbbfe3240b4d8ed171867786ad | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31-01-2024 12:29

Sharing

Report Analysis Logs

General

Target

True2ScanCL.dll
Size

164KB
MD5

ac0cde9828c5f06bd4b810d2b572d341
SHA1

111ae07023c80a1d3a66ffa005effe0cd9a7de46
SHA256

5edb512e49850c5c27f73ab7f0b1e55e91708410c9b5094ff3d8e1d32ecf3938
SHA512

674ccbbf15ac14d1745c8cccf45ef3c5a438d579568535f88d1de93905446117a726550cf498bebdcc2c017f8f3750c439dac1998d925a59836d8273a8841c46
SSDEEP

3072:nnQw3S+EpfpSb9dHe7HcSZve+TovBSPlOeK0KDo:nnqnf8NO8SZWU4e

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2328 2184 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 836 wrote to memory of 2184	836	rundll32.exe	rundll32.exe
PID 836 wrote to memory of 2184	836	rundll32.exe	rundll32.exe
PID 836 wrote to memory of 2184	836	rundll32.exe	rundll32.exe
PID 836 wrote to memory of 2184	836	rundll32.exe	rundll32.exe
PID 836 wrote to memory of 2184	836	rundll32.exe	rundll32.exe
PID 836 wrote to memory of 2184	836	rundll32.exe	rundll32.exe
PID 836 wrote to memory of 2184	836	rundll32.exe	rundll32.exe
PID 2184 wrote to memory of 2328	2184	rundll32.exe	WerFault.exe
PID 2184 wrote to memory of 2328	2184	rundll32.exe	WerFault.exe
PID 2184 wrote to memory of 2328	2184	rundll32.exe	WerFault.exe
PID 2184 wrote to memory of 2328	2184	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\True2ScanCL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:836

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\True2ScanCL.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 228
3⤵
- Program crash
PID:2328

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...