3f23067d87d4fe883d4aca812055c30d98f7e7b7fe06ddf134e97821dda3cba9 | Triage

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/02/2024, 05:54

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/KillProcDLL.dll
Size

4KB
MD5

99f345cf51b6c3c317d20a81acb11012
SHA1

b3d0355f527c536ea14a8ff51741c8739d66f727
SHA256

c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93
SHA512

937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process
2552	2272	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 2272	2532	rundll32.exe	2
PID 2532 wrote to memory of 2272	2532	rundll32.exe	2
PID 2532 wrote to memory of 2272	2532	rundll32.exe	2
PID 2532 wrote to memory of 2272	2532	rundll32.exe	2
PID 2532 wrote to memory of 2272	2532	rundll32.exe	2
PID 2532 wrote to memory of 2272	2532	rundll32.exe	2
PID 2532 wrote to memory of 2272	2532	rundll32.exe	2
PID 2272 wrote to memory of 2552	2272	rundll32.exe	1
PID 2272 wrote to memory of 2552	2272	rundll32.exe	1
PID 2272 wrote to memory of 2552	2272	rundll32.exe	1
PID 2272 wrote to memory of 2552	2272	rundll32.exe	1

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 228
1⤵
- Program crash
PID:2552

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\KillProcDLL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2272

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\KillProcDLL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2272-0-0x0000000010000000-0x0000000010003000-memory.dmp

Filesize
12KB

Download
memory/2272-1-0x0000000010000000-0x0000000010003000-memory.dmp

Filesize
12KB

Download