2c63d2c57556b971b68215b6a6bf82eba8fc018af5ede48ca006230c31a0b752 | Triage

Analysis

max time kernel
1788s
max time network
1795s
platform
windows10-2004_x64
resource
win10v2004-20231222-es
resource tags

arch:x64arch:x86image:win10v2004-20231222-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
14-02-2024 17:35

Sharing

Report Analysis Logs

General

Target

jli.dll
Size

33.5MB
MD5

4c640ce66294885c715e6c5313fcca0b
SHA1

76d188a3f9d451d3b066e0de792c27124d6e018f
SHA256

fcc51212aa7f182de347f149a7c74cf5a87f17cbada5dc69f03be80e1bbda996
SHA512

354c35e1c22de99758406e2de2bda63257e0b8907f3f09e075b50017eb14da5a827ba5f3345bb5ece2bf384fed7735e485555c7a63da197580ca0e5a16ce481f
SSDEEP

196608:TohVCzBADUgcSTaOAsJf0OWOoF5/RrbKgbGDFg0Rb:TohVYGDUgcSTaOJh0OIL/N1Q/V

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5092 1940 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4976 wrote to memory of 1940	4976	rundll32.exe	rundll32.exe
PID 4976 wrote to memory of 1940	4976	rundll32.exe	rundll32.exe
PID 4976 wrote to memory of 1940	4976	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jli.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4976

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jli.dll,#1
2⤵
PID:1940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 664
3⤵
- Program crash
PID:5092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1940 -ip 1940
1⤵
PID:4484

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1940-0-0x0000000072FB0000-0x0000000075142000-memory.dmp

Filesize
33.6MB

Download