b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee | Triage

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
10-02-2024 18:16

Sharing

Report Analysis Logs

General

Target

disembarkation.dll
Size

24KB
MD5

1bea7d9e09e15e62b38474e87b5c1041
SHA1

e5003f5894fe17b517a07a35a270c73506398a5e
SHA256

b8bb9c23722c115730f68c1de7e970cab39b7e4a581edc1759cecdd0b2288297
SHA512

de552003490a1df588360aea93508375034770d48fc03b680895a5da22430ecd05d64c2b0f6f6e00c30a899c219fb39e4a26803588ff1856a8465b80ef1b7395
SSDEEP

192:2HGm3EJs4k3qFnX8VtK5FOgLt5Mm/cwOMb:H8ES4k3GX8DOtmm/cw

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3164 3652 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4472 wrote to memory of 3652	4472	rundll32.exe	rundll32.exe
PID 4472 wrote to memory of 3652	4472	rundll32.exe	rundll32.exe
PID 4472 wrote to memory of 3652	4472	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\disembarkation.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\disembarkation.dll,#1
  2⤵
  PID:3652
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3652 -s 568
    3⤵
    - Program crash
    PID:3164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3652 -ip 3652
1⤵
PID:4308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads