6dd1b5594b061e0579a65b8a08f30994bb5c4a30c6d9fa99e575f15538a77c76 | Triage

Analysis

max time kernel
92s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 02:48

Sharing

Report Analysis Logs

General

Target

a0c06552150a37f766cb9915903e1038.dll
Size

2KB
MD5

a0c06552150a37f766cb9915903e1038
SHA1

2a36cf9e16069ef16f148cf29f628b7c42700377
SHA256

6dd1b5594b061e0579a65b8a08f30994bb5c4a30c6d9fa99e575f15538a77c76
SHA512

f8abea79c43e0cbeaeb646e1f4f8230cfdbfd8d47b4e05914bb89fc18fe257a926a3896ad71c62adc28f3f682632dcbc1125123d573207c3d47e152add4deb8a

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2836	648	WerFault.exe	31

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 648	2452	rundll32.exe	31
PID 2452 wrote to memory of 648	2452	rundll32.exe	31
PID 2452 wrote to memory of 648	2452	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a0c06552150a37f766cb9915903e1038.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a0c06552150a37f766cb9915903e1038.dll,#1
  2⤵
  PID:648
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 648 -s 412
    3⤵
    - Program crash
    PID:2836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 648 -ip 648
1⤵
PID:5104

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/648-0-0x0000000030000000-0x00000000303B0000-memory.dmp

Filesize
3.7MB

Download