230f0082865e50035b6852690a86d1c58cdf8f04849bcd108b5f47bfd1fd4f0b | Triage

Resubmissions

22/02/2024, 02:16

240222-cp8shaah72 7

22/02/2024, 02:13

240222-cnpm8sah54 7

Analysis

max time kernel
142s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/02/2024, 02:13

Sharing

Report Analysis Logs

General

Target

prerrlog.dll
Size

46KB
MD5

8447c184c035ac126d030e07ca2313f1
SHA1

7ca9e8c500ca067e52f93faba011b0bfecd9b9f8
SHA256

b82d8495194156003b28f881e8fd6e11637ac5ff861834f4d596272eedf4247f
SHA512

a689d9b63206382726ac2cb9878dc40a7b9f1dbe2a99bec465905be6cc55fe1e8f4865029ce25ad45279f07175124515802c21a46eebfb94462be7ea8894bd70
SSDEEP

768:55OoUpowWNg5V2cL7r9nbsGnLNHsWnPJ7UxhR5HriFRQiF:GjuSVxZbsGntp+hR5HriFRL

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral15/memory/2024-0-0x0000000010000000-0x0000000010017000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2704	2024	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 2024	2296	rundll32.exe	28
PID 2296 wrote to memory of 2024	2296	rundll32.exe	28
PID 2296 wrote to memory of 2024	2296	rundll32.exe	28
PID 2296 wrote to memory of 2024	2296	rundll32.exe	28
PID 2296 wrote to memory of 2024	2296	rundll32.exe	28
PID 2296 wrote to memory of 2024	2296	rundll32.exe	28
PID 2296 wrote to memory of 2024	2296	rundll32.exe	28
PID 2024 wrote to memory of 2704	2024	rundll32.exe	29
PID 2024 wrote to memory of 2704	2024	rundll32.exe	29
PID 2024 wrote to memory of 2704	2024	rundll32.exe	29
PID 2024 wrote to memory of 2704	2024	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\prerrlog.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\prerrlog.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2024
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 228
    3⤵
    - Program crash
    PID:2704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2024-0-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download