87543ad5e0f88baff746c916a54629b9806e03b37525708c26af6d4dcb29322b | Triage

Analysis

max time kernel
137s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/02/2024, 12:26

Sharing

Report Analysis Logs

General

Target

8f25f2de84b9cdac76024eeea3c5bf90.dll
Size

72KB
MD5

8f25f2de84b9cdac76024eeea3c5bf90
SHA1

d58d5ffa01c3fa2cf83abec7679eaea985d51bdc
SHA256

87543ad5e0f88baff746c916a54629b9806e03b37525708c26af6d4dcb29322b
SHA512

c0d7a5a5bfb579939d03cbdfb1a77df3c06de75a2f05ce5b6ee0b9b57603f3c99b9a582afb5add66e6237774af5651349e90e02f17d5893205e866d564550a9e
SSDEEP

1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuv:C5UOq0ukgOK2l7aFQv

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3256	2732	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 2732	4896	rundll32.exe	84
PID 4896 wrote to memory of 2732	4896	rundll32.exe	84
PID 4896 wrote to memory of 2732	4896	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8f25f2de84b9cdac76024eeea3c5bf90.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8f25f2de84b9cdac76024eeea3c5bf90.dll,#1
  2⤵
  PID:2732
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 600
    3⤵
    - Program crash
    PID:3256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2732 -ip 2732
1⤵
PID:2056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads