18c74dde6426a0637bbdfff078e677fe9813391e7db685735f90cc42ac1cd231 | Triage

Resubmissions

18-02-2024 15:25

240218-stk51abf4z 10

18-02-2024 15:19

240218-sp9ykabf2v 10

18-02-2024 14:45

240218-r46c9abc7w 10

Analysis

max time kernel
30s
max time network
18s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18-02-2024 15:19

Sharing

Report Analysis Logs

General

Target

Minty/concrt140.dll
Size

310KB
MD5

cd12471b295f6a1c66dcc9fc519eef5b
SHA1

dbca64bc390ea30d54c184086f0505fef35cd969
SHA256

573229a07f38ab9d2fc2e1a5b98e9243b9b39100323180c83ad7ddaf98eee46a
SHA512

c8a75f285e12f3e65ea18b002d4661f01ebf54d464fec761917ac09709ff6005f0e15bf76756ccde8d19fe88f096d05df20bab252bb2c26248af5aaad846b988
SSDEEP

6144:1EI93zcNn3dMiBXHxHSSXfPnevwbbeVu00Xp9gznWzgQQf3P2iyK:aIlwNqihUSPPd9z8yK

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2140 wrote to memory of 2040	2140	rundll32.exe	WerFault.exe
PID 2140 wrote to memory of 2040	2140	rundll32.exe	WerFault.exe
PID 2140 wrote to memory of 2040	2140	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Minty\concrt140.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2140 -s 84
  2⤵
  PID:2040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads