3b79a842b7bad93ca9f64869b996d159ffa3ed2d3a2a4a82b778b050e6450599 | Triage

Analysis

max time kernel
92s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2024, 11:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

dmload.dll
Size

476KB
MD5

1fbeae5d32065c647d0e9fc4f5cade8b
SHA1

5b8794466d243bcdd3ec78fd0544bc4fcbfca2bb
SHA256

c3546f895cbf24a4c46928154220528758893b1f53b0175501654e999d24c2f8
SHA512

6683309c81295b3fffd11dea09719ced839fdb1e9e5a68a221432211eb7d5730b369d866465b7526420bf9ac941c7678432a98b05920700637a8a48aa888b13a
SSDEEP

6144:rcv21q2Co4sXFdT6g/gKD0ddTvlT6PFGY3xKpriTKA+40W17Y3oU5OQ/:Omv/gsJ0priTb7c/

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4424	1680	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3884 wrote to memory of 1680	3884	rundll32.exe	85
PID 3884 wrote to memory of 1680	3884	rundll32.exe	85
PID 3884 wrote to memory of 1680	3884	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dmload.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3884
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dmload.dll,#1
  2⤵
  PID:1680
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1680 -s 724
    3⤵
    - Program crash
    PID:4424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1680 -ip 1680
1⤵
PID:2608

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1680-0-0x00000000010D0000-0x00000000010EB000-memory.dmp

Filesize
108KB

Download
memory/1680-2-0x0000000001360000-0x00000000013B8000-memory.dmp

Filesize
352KB

Download