986d567b5410076deaa5bc92a23e9594ba79a5deb9742adbfe6834075a32d0ef | Triage

Analysis

max time kernel
92s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01/02/2024, 13:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

86f305a27da8ef402c8d2b1b8713cea3.dll
Size

37KB
MD5

86f305a27da8ef402c8d2b1b8713cea3
SHA1

9e2d40350bdee6f5b87b7761fefd8f7b330abf70
SHA256

986d567b5410076deaa5bc92a23e9594ba79a5deb9742adbfe6834075a32d0ef
SHA512

f46af21201db32beb8d3308d5a1c5e4ac7d6eb630be144bd31cdb26d36066046eaeb971a1cc805b223ff1eefaf3054b53a0a7d7e1e778895f0a3cc1b21932668
SSDEEP

768:FyIqvQsMiY8+Q1u1iezcUXqMWxYm8esNenuIj5cw0qS:kIqvQ2YWUbWWm8esNwgn

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
536	2260	WerFault.exe	22

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3224 wrote to memory of 2260	3224	rundll32.exe	22
PID 3224 wrote to memory of 2260	3224	rundll32.exe	22
PID 3224 wrote to memory of 2260	3224	rundll32.exe	22

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\86f305a27da8ef402c8d2b1b8713cea3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3224
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\86f305a27da8ef402c8d2b1b8713cea3.dll,#1
  2⤵
  PID:2260
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 632
    3⤵
    - Program crash
    PID:536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2260 -ip 2260
1⤵
PID:3068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2260-0-0x0000000000800000-0x000000000080F000-memory.dmp

Filesize
60KB

Download
memory/2260-1-0x0000000000800000-0x000000000080F000-memory.dmp

Filesize
60KB

Download