1c6df026b501c1bd0bd7538d1ad29c41565ee60a9441ae183f00d5409e0b48b4 | Triage

Analysis

max time kernel
3s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
09-02-2024 08:52

Sharing

Report Analysis Logs

General

Target

Minty/chrome_elf.dll
Size

690KB
MD5

4bc92038a76a457a1c36499bd843aa1a
SHA1

0ec0ab717f116231ee1f120e958aa1876845ffb0
SHA256

6084e9d7bf40c57c141e99fd061671abbf82dda61e8567dab22d4b5fdbc0cc29
SHA512

2ad8b1432bd79879d92e0d64ac0a5f14f554683a123e7fb86622a5263c3844c218d14495f60b4987add2e2d425348b3b63c1c398ae7ab5c59f11f22f7ef3e768
SSDEEP

12288:dRn335tvsz6Xu1HkXh312ix5zqYDoYFEaaqHudbjnySWGG7Kn:fH5tv4J1HkR3hoYe8i

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2936	4484	WerFault.exe	77

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 4484	2592	rundll32.exe	77
PID 2592 wrote to memory of 4484	2592	rundll32.exe	77
PID 2592 wrote to memory of 4484	2592	rundll32.exe	77

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Minty\chrome_elf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Minty\chrome_elf.dll,#1
  2⤵
  PID:4484
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 456
    3⤵
    - Program crash
    PID:2936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4484 -ip 4484
1⤵
PID:1404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads