721feb04d1fa90401081c97e2f1ad97d60b9823d07fb441d61b10dc463333ce4 | Triage

Analysis

max time kernel
91s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2024, 09:36

Sharing

Report Analysis Logs

General

Target

8bff6b9b9fd4bd9870c19d5a24040815.dll
Size

68KB
MD5

8bff6b9b9fd4bd9870c19d5a24040815
SHA1

47b47fb86ede41a09d8f921a0d0998611dc6ab10
SHA256

721feb04d1fa90401081c97e2f1ad97d60b9823d07fb441d61b10dc463333ce4
SHA512

3d6b1f4b021c6021e8b835d7dde77b08ac1a09720cfad07374eae11c4428b073a2b1bdf2b80b9bcc07b159381b5cdffea33ba316b0b1807793e40915da418155
SSDEEP

1536:bnPECSFATsckUEVWQ5YIPXXtJ9KpxcDTV+ZC:bn8CgATTMlr8o/V+w

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3056	1496	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3112 wrote to memory of 1496	3112	rundll32.exe	84
PID 3112 wrote to memory of 1496	3112	rundll32.exe	84
PID 3112 wrote to memory of 1496	3112	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8bff6b9b9fd4bd9870c19d5a24040815.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3112
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8bff6b9b9fd4bd9870c19d5a24040815.dll,#1
  2⤵
  PID:1496
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1496 -s 560
    3⤵
    - Program crash
    PID:3056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1496 -ip 1496
1⤵
PID:3988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads