2c63d2c57556b971b68215b6a6bf82eba8fc018af5ede48ca006230c31a0b752 | Triage

Analysis

max time kernel
1800s
max time network
1822s
platform
windows7_x64
resource
win7-20231215-es
resource tags

arch:x64arch:x86image:win7-20231215-eslocale:es-esos:windows7-x64systemwindows
submitted
14-02-2024 17:35

Sharing

Report Analysis Logs

General

Target

jli.dll
Size

33.5MB
MD5

4c640ce66294885c715e6c5313fcca0b
SHA1

76d188a3f9d451d3b066e0de792c27124d6e018f
SHA256

fcc51212aa7f182de347f149a7c74cf5a87f17cbada5dc69f03be80e1bbda996
SHA512

354c35e1c22de99758406e2de2bda63257e0b8907f3f09e075b50017eb14da5a827ba5f3345bb5ece2bf384fed7735e485555c7a63da197580ca0e5a16ce481f
SSDEEP

196608:TohVCzBADUgcSTaOAsJf0OWOoF5/RrbKgbGDFg0Rb:TohVYGDUgcSTaOJh0OIL/N1Q/V

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2872 2460 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2744 wrote to memory of 2460	2744	rundll32.exe	rundll32.exe
PID 2744 wrote to memory of 2460	2744	rundll32.exe	rundll32.exe
PID 2744 wrote to memory of 2460	2744	rundll32.exe	rundll32.exe
PID 2744 wrote to memory of 2460	2744	rundll32.exe	rundll32.exe
PID 2744 wrote to memory of 2460	2744	rundll32.exe	rundll32.exe
PID 2744 wrote to memory of 2460	2744	rundll32.exe	rundll32.exe
PID 2744 wrote to memory of 2460	2744	rundll32.exe	rundll32.exe
PID 2460 wrote to memory of 2872	2460	rundll32.exe	WerFault.exe
PID 2460 wrote to memory of 2872	2460	rundll32.exe	WerFault.exe
PID 2460 wrote to memory of 2872	2460	rundll32.exe	WerFault.exe
PID 2460 wrote to memory of 2872	2460	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jli.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2744

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jli.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 256
3⤵
- Program crash
PID:2872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2460-0-0x000000006F100000-0x0000000071292000-memory.dmp

Filesize
33.6MB

Download