81b709b7cf2379333d21cf9b24da8f989b43148838175e7fa5d987493cb92d0d | Triage

Analysis

max time kernel
134s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12-02-2024 06:51

Sharing

Report Analysis Logs

General

Target

9689d69e87390da0a233566b6672af57.dll
Size

83KB
MD5

9689d69e87390da0a233566b6672af57
SHA1

1e15622976866a98a2ab0d1bb7efd5df558ac589
SHA256

81b709b7cf2379333d21cf9b24da8f989b43148838175e7fa5d987493cb92d0d
SHA512

9784c6517e33066fdea946493f72db06d4e7f4dba70e55cfa8db82ddaebfdd9b5bccb286f6cabdd6ccc7888dac59de4a5ce161b6762281582b393fbde7ed4b30
SSDEEP

1536:FMKegfzkQLCles6IRPOZR1RnK8AHDGRF33rU+I:FMNQulrr2BxK8AHKRFHI+I

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3360	2552	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4596 wrote to memory of 2552	4596	rundll32.exe	84
PID 4596 wrote to memory of 2552	4596	rundll32.exe	84
PID 4596 wrote to memory of 2552	4596	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9689d69e87390da0a233566b6672af57.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9689d69e87390da0a233566b6672af57.dll,#1
  2⤵
  PID:2552
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 544
    3⤵
    - Program crash
    PID:3360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2552 -ip 2552
1⤵
PID:1140

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2552-0-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/2552-1-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download