98c0d913bef9590b932a6ba41851fce772ee0fe96b7e9f77893828562699f780 | Triage

Analysis

max time kernel
140s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/02/2024, 03:33

Sharing

Report Analysis Logs

General

Target

8e1c2fa9fd10e419ef1120745e948560.dll
Size

25KB
MD5

8e1c2fa9fd10e419ef1120745e948560
SHA1

c3953162711779f20d13ce7dc3610f656e5eb3d3
SHA256

98c0d913bef9590b932a6ba41851fce772ee0fe96b7e9f77893828562699f780
SHA512

ed79f29c1e8e3e982ff9ef4fd057c3bbf23ef2900c55e397970ddbed28d29a7233a161a121a3e8b63a1dfba21de2a5ff32fcf52f44be2e8891ae3c23411c861f
SSDEEP

768:7laZpXlXBN1Fq9kFBrrT40yDgaLfxmyIs9d4q1yDJRn:7laHxK9uPyIs9d48

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1532	4280	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 4280	2984	rundll32.exe	84
PID 2984 wrote to memory of 4280	2984	rundll32.exe	84
PID 2984 wrote to memory of 4280	2984	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8e1c2fa9fd10e419ef1120745e948560.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8e1c2fa9fd10e419ef1120745e948560.dll,#1
  2⤵
  PID:4280
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4280 -s 540
    3⤵
    - Program crash
    PID:1532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4280 -ip 4280
1⤵
PID:4452

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4280-0-0x0000000000640000-0x0000000000740000-memory.dmp

Filesize
1024KB

Download