df430e88e62b426b7c75ba29eb28eff3b77714999a28c6f9aa9172085f78cd3a | Triage

Analysis

max time kernel
144s
max time network
207s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04-03-2024 00:18

Sharing

Report Analysis Logs

General

Target

vccorlib140.dll
Size

263KB
MD5

9d6b6cc0d78293648f587db00074680b
SHA1

0201d3fd949da6c5a5d0804c40d014c8db355b97
SHA256

5970e64321d2cc32352ed3bd513f36e28a7034d6ae02f870a782aef369d44045
SHA512

e8091875eaae6da7bd04a7eb172a38046e1cb21e52f1b0d0a913b84763f8fcf5e850c5cf8c46f94087af1e6545bf9c4b987e1f6994eec95cb32ed788a57785c1
SSDEEP

6144:dGpqgVlbqCDAqsfeP67StJpxL0Me83g/2uAOg3:dGs+48APlOnEAOg3

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2128	1128	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 64 wrote to memory of 1128	64	rundll32.exe	90
PID 64 wrote to memory of 1128	64	rundll32.exe	90
PID 64 wrote to memory of 1128	64	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vccorlib140.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:64
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\vccorlib140.dll,#1
  2⤵
  PID:1128
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1128 -s 616
    3⤵
    - Program crash
    PID:2128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1128 -ip 1128
1⤵
PID:4308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads