044bbcf71ab892f2065c22944715263665d574ada1e44681eeaed74d928b1c00 | Triage

Analysis

max time kernel
93s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2024, 02:06

Sharing

Report Analysis Logs

General

Target

aab9ef3e7e40a0ca053d5528c956e072.dll
Size

72KB
MD5

aab9ef3e7e40a0ca053d5528c956e072
SHA1

38cada64a5ed0f9ef78b8490c7248db257c3b40f
SHA256

044bbcf71ab892f2065c22944715263665d574ada1e44681eeaed74d928b1c00
SHA512

a18e1fb9be156885b3a9d9eab5cd9230c3c14cf031ed306452e4a4252db94b32201d49fc1c7b3daa38d88eda202ff5281cbbc71ebfca6c81d352d069254bff85
SSDEEP

1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuv:C5UOq0ukgOK2l7aFQv

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4144	4700	WerFault.exe	78

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 4700	1396	rundll32.exe	78
PID 1396 wrote to memory of 4700	1396	rundll32.exe	78
PID 1396 wrote to memory of 4700	1396	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aab9ef3e7e40a0ca053d5528c956e072.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\aab9ef3e7e40a0ca053d5528c956e072.dll,#1
  2⤵
  PID:4700
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 600
    3⤵
    - Program crash
    PID:4144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4700 -ip 4700
1⤵
PID:1184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads