da51aca27777c2fd13be2e099f6657b7815633bbbfe3240b4d8ed171867786ad | Triage

Analysis

max time kernel
137s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31-01-2024 12:29

Sharing

Report Analysis Logs

General

Target

True2ScanCL.dll
Size

164KB
MD5

ac0cde9828c5f06bd4b810d2b572d341
SHA1

111ae07023c80a1d3a66ffa005effe0cd9a7de46
SHA256

5edb512e49850c5c27f73ab7f0b1e55e91708410c9b5094ff3d8e1d32ecf3938
SHA512

674ccbbf15ac14d1745c8cccf45ef3c5a438d579568535f88d1de93905446117a726550cf498bebdcc2c017f8f3750c439dac1998d925a59836d8273a8841c46
SSDEEP

3072:nnQw3S+EpfpSb9dHe7HcSZve+TovBSPlOeK0KDo:nnqnf8NO8SZWU4e

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3256 5048 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3952 wrote to memory of 5048	3952	rundll32.exe	rundll32.exe
PID 3952 wrote to memory of 5048	3952	rundll32.exe	rundll32.exe
PID 3952 wrote to memory of 5048	3952	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\True2ScanCL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3952

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\True2ScanCL.dll,#1
2⤵
PID:5048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 628
3⤵
- Program crash
PID:3256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 5048 -ip 5048
1⤵
PID:3440

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads