c79173b33e1bb2001250fa66d77afb01335249573680170310e6ba5ba55bc4fd | Triage

Analysis

max time kernel
95s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2024, 05:53

Sharing

Report Analysis Logs

General

Target

ab281e539d9e2dbdc5ca4862ef847f47.dll
Size

29KB
MD5

ab281e539d9e2dbdc5ca4862ef847f47
SHA1

a6fab0f1021f23ae3e60ca39c54ac52dad67f7b6
SHA256

c79173b33e1bb2001250fa66d77afb01335249573680170310e6ba5ba55bc4fd
SHA512

46594d9cfb4a1d6aacc3db1a617c343c06b14f209e97926fed66346032511979af223a4f6407ca49eda9a502388fd94914f3ba2d3da3cdb20a63d1164c6b6a0c
SSDEEP

768:FnUh2FbFSvMrLLqz9d5iLD1T8m7dln04Sr+:FnUh6rrqz9bixz

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4820	3484	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 8 wrote to memory of 3484	8	rundll32.exe	88
PID 8 wrote to memory of 3484	8	rundll32.exe	88
PID 8 wrote to memory of 3484	8	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab281e539d9e2dbdc5ca4862ef847f47.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:8
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab281e539d9e2dbdc5ca4862ef847f47.dll,#1
  2⤵
  PID:3484
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3484 -s 560
    3⤵
    - Program crash
    PID:4820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3484 -ip 3484
1⤵
PID:2672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3484-0-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download