c25f3790c9e3fa923120f4a04aab2f6270a164137faa488f17b1b4175081b127 | Triage

Analysis

max time kernel
115s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2024, 05:35

Sharing

Report Analysis Logs

General

Target

ab204ec28029082d19489ef3232ed272.dll
Size

13KB
MD5

ab204ec28029082d19489ef3232ed272
SHA1

cee3a01b6c7432eeeb1e84d49704ad4cc9a2f511
SHA256

c25f3790c9e3fa923120f4a04aab2f6270a164137faa488f17b1b4175081b127
SHA512

c8a43928a7eb5c4f2a465136efabf8ec0ae903085af0b037b731c75c9b5cb785dc0891e67cf4b7119260bb0219eb048d2e688800a83ce9eadac5eddd792b924e
SSDEEP

384:UmhaavQF9gX+Tw0wFnQIGygSDG2jFmLwq:UmKF9RTB4QICSDGQFmLwq

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2280	3920	WerFault.exe	34

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 3920	1364	rundll32.exe	34
PID 1364 wrote to memory of 3920	1364	rundll32.exe	34
PID 1364 wrote to memory of 3920	1364	rundll32.exe	34

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab204ec28029082d19489ef3232ed272.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab204ec28029082d19489ef3232ed272.dll,#1
  2⤵
  PID:3920
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 568
    3⤵
    - Program crash
    PID:2280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3920 -ip 3920
1⤵
PID:1648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4088 --field-trial-handle=2256,i,18272763564106695635,11201593968620719822,262144 --variations-seed-version /prefetch:8
1⤵
PID:4688

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3920-0-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download