3f8320152704377de150418a3c4c9d07d16d80a6c0d0d8f7289c22c499e33571 | Triage

Analysis

max time kernel
88s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
05/03/2024, 16:06

Sharing

Report Analysis Logs

General

Target

platform-tools/AdbWinUsbApi.dll
Size

71KB
MD5

d070bde6d02d13d0965313fdb7dfdfc3
SHA1

151867f1544085e40cc71ecf402a29df28f85aa1
SHA256

e6141805bb19eeafac6ab2d0fb50aa098b8c27149dc8ed73739cc40436274748
SHA512

a163207c61ff8ac917d6b8246ce92d04fbc16915cb9f5bc309c1ee8f9c85a0926f9475c81e050d9d454f5d535085b5691a88b87b944472a99212bfbd30e6f37d
SSDEEP

1536:672doFmOiHizFbPlspcsbj5ZsP+YeTs1pc75WxdO:6SSfN9+YeTs1pcFB

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2816	2364	WerFault.exe	77

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1920 wrote to memory of 2364	1920	rundll32.exe	77
PID 1920 wrote to memory of 2364	1920	rundll32.exe	77
PID 1920 wrote to memory of 2364	1920	rundll32.exe	77

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\platform-tools\AdbWinUsbApi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\platform-tools\AdbWinUsbApi.dll,#1
  2⤵
  PID:2364
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 496
    3⤵
    - Program crash
    PID:2816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2364 -ip 2364
1⤵
PID:5004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads