18b946137a871e1086fe8ee1a90700ff96fea1a7afe5711068db8d05bdd61894 | Triage

Analysis

max time kernel
142s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/02/2024, 11:01

Sharing

Report Analysis Logs

General

Target

borlndmm.dll
Size

31KB
MD5

5bda680c2be14d02274f95188fef651c
SHA1

873f9e69132ef682c059a3a745bc240c00549d3f
SHA256

757f4e9a5db7f79037ce6bc690bd396ef8a73e911b7d3d404e1efd77de843bc0
SHA512

dff81e277f869f80c436766bb4dde7e1865d800719d6b8f353dcb1a230e3f5a87ed6582aaa373adf796690cd89b5bfff15d581be9cccbef97f9dc854b919109f
SSDEEP

768:Jha3Jo1V/ija+1IIZGk4gakqVcEkfHL/ija+1IsVAgvMicmN:Jha3Jo2l4gaPcBfAAgdcmN

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1768	3068	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 3068	2864	rundll32.exe	28
PID 2864 wrote to memory of 3068	2864	rundll32.exe	28
PID 2864 wrote to memory of 3068	2864	rundll32.exe	28
PID 2864 wrote to memory of 3068	2864	rundll32.exe	28
PID 2864 wrote to memory of 3068	2864	rundll32.exe	28
PID 2864 wrote to memory of 3068	2864	rundll32.exe	28
PID 2864 wrote to memory of 3068	2864	rundll32.exe	28
PID 3068 wrote to memory of 1768	3068	rundll32.exe	29
PID 3068 wrote to memory of 1768	3068	rundll32.exe	29
PID 3068 wrote to memory of 1768	3068	rundll32.exe	29
PID 3068 wrote to memory of 1768	3068	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\borlndmm.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\borlndmm.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 228
    3⤵
    - Program crash
    PID:1768

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3068-0-0x0000000020FF0000-0x0000000021002000-memory.dmp

Filesize
72KB

Download