478e5a10a2d3f41fd903448dd9d06c7d901a53933cfa7d90f10d905d01c8fb49 | Triage

Analysis

max time kernel
93s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2024, 05:13

Sharing

Report Analysis Logs

General

Target

$0/wyeke.dll
Size

584KB
MD5

8d72049838c972e95f059074964caef3
SHA1

d3c6fe1e7fde339e20fad30dd442381355d9c864
SHA256

8cccccba3915668213fd73ec202a291ad8eb9920e7bc01e876ec7584e6302f8b
SHA512

a2213bb7e0c1f7aa3bf901b191b2408019d6a43213438b159c7548562d160358a12f7c218054fb441a61f01c60e657165702ab0245b741965949e272a558ed82
SSDEEP

12288:nEG5JNaYqvQ96roOMcIga0TqOV4FIV5EJa0ZyowlE5ZsarNp:n7I3vpMoa0Tq10Ds1r1N

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4080	4704	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4408 wrote to memory of 4704	4408	rundll32.exe	83
PID 4408 wrote to memory of 4704	4408	rundll32.exe	83
PID 4408 wrote to memory of 4704	4408	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$0\wyeke.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$0\wyeke.dll,#1
  2⤵
  PID:4704
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 672
    3⤵
    - Program crash
    PID:4080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4704 -ip 4704
1⤵
PID:1492

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4704-0-0x0000000002730000-0x00000000027B4000-memory.dmp

Filesize
528KB

Download