09a03fa9a9b91cfe0bcfe7a8d98e042abf2a65fcd0222a41bde61c81bf9a3761 | Triage

Analysis

max time kernel
91s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
25/02/2024, 06:11

Sharing

Report Analysis Logs

General

Target

a3146ba3bfd6ef2bfb45c0c069a2fb8b.dll
Size

26KB
MD5

a3146ba3bfd6ef2bfb45c0c069a2fb8b
SHA1

8e7613102338f8210ab88b264e8c5e5bfcbf1c87
SHA256

09a03fa9a9b91cfe0bcfe7a8d98e042abf2a65fcd0222a41bde61c81bf9a3761
SHA512

de59c48de9a7841f0c67fd31cbb818aeaad1acba74c2bc44cc2237255d514b3eda1a90e67a6d39355b858ff700210a809cf9039ba299e536a1d10a30c282d5e8
SSDEEP

768:+dsLPYIhpZT6YOrAaaV9Y5ivTNzztrHDOajs4F:qsLQIdT3uonvTNzztrbh

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4072	2888	WerFault.exe	39

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 2888	4716	rundll32.exe	39
PID 4716 wrote to memory of 2888	4716	rundll32.exe	39
PID 4716 wrote to memory of 2888	4716	rundll32.exe	39

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3146ba3bfd6ef2bfb45c0c069a2fb8b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3146ba3bfd6ef2bfb45c0c069a2fb8b.dll,#1
  2⤵
  PID:2888
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 540
    3⤵
    - Program crash
    PID:4072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2888 -ip 2888
1⤵
PID:1144

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2888-0-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download