9d666fc28b639c2ad9e342af4845a6515b9baf566f2cee9f9bd514bda67161e9 | Triage

Analysis

max time kernel
152s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 10:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b73d13289c532f7a57f12e3c84893394.dll
Size

33KB
MD5

b73d13289c532f7a57f12e3c84893394
SHA1

373b965d9de525952a28a1ead19272419d03e86f
SHA256

9d666fc28b639c2ad9e342af4845a6515b9baf566f2cee9f9bd514bda67161e9
SHA512

733ee886199183783f95cc55a4fd89620553960414f389036473bf4f758ce7449894c41c2d6938dfa95e0511fccd79fb5d49563ae90d5efaf6dbce2038cdec70
SSDEEP

768:KbTdbjsi0jKsWMuft9wqJbkie/buWBa7tTPuLm:sTdEWMOt9wuoiG6Aa1P4m

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2460	1820	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 1820	3012	rundll32.exe	88
PID 3012 wrote to memory of 1820	3012	rundll32.exe	88
PID 3012 wrote to memory of 1820	3012	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b73d13289c532f7a57f12e3c84893394.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b73d13289c532f7a57f12e3c84893394.dll,#1
  2⤵
  PID:1820
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 580
    3⤵
    - Program crash
    PID:2460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1820 -ip 1820
1⤵
PID:3692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1820-0-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/1820-1-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download