4aa77f9087fdd1e0e6c14368e5dba63b4604729d62c66a659a6e090e85b5da74 | Triage

Analysis

max time kernel
90s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2024, 04:54

Sharing

Report Analysis Logs

General

Target

9acddb4a53dcd5269679933cc3427cda.dll
Size

17KB
MD5

9acddb4a53dcd5269679933cc3427cda
SHA1

62eb059ee4ec02bd74f2add9d8d214c3a51c861d
SHA256

4aa77f9087fdd1e0e6c14368e5dba63b4604729d62c66a659a6e090e85b5da74
SHA512

298bbddc220358c1137af5b0fdd37165b513e021ce05db9c8b852019280ebd6b26fee3dae60b85459c5cfd7de64eeab2bdfa296e343be9fce2c9c6b493beae9f
SSDEEP

384:AJUo/w/F0YzWsrWzM8PkTGKX8WIbxzMQsi34:wU3/WYSs8WGKs5RMQsi34

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3808	4556	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3964 wrote to memory of 4556	3964	rundll32.exe	83
PID 3964 wrote to memory of 4556	3964	rundll32.exe	83
PID 3964 wrote to memory of 4556	3964	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9acddb4a53dcd5269679933cc3427cda.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9acddb4a53dcd5269679933cc3427cda.dll,#1
  2⤵
  PID:4556
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 552
    3⤵
    - Program crash
    PID:3808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4556 -ip 4556
1⤵
PID:2096

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4556-0-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download