d7e328a43071e5515c051cfef3911bebf5e3c4b7cfd42c4b9988a5e6d4cb12be | Triage

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2024, 16:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b92180c63d76127643d4e56ea783abfd.dll
Size

213KB
MD5

b92180c63d76127643d4e56ea783abfd
SHA1

a6e3c619aa77b46f18b4355f72a9d57392802a46
SHA256

d7e328a43071e5515c051cfef3911bebf5e3c4b7cfd42c4b9988a5e6d4cb12be
SHA512

c42a986f85e615e49329e728060271dbb843cb7621bfdc08571e7fcffa9c0ce679eb37cb90ee1a68c6dd951829dce260e9947d944333d8c7b00805e6085a2d40
SSDEEP

6144:DaQeE+MwMEKS6Jn74Fcd5Ooh8rzo3+wJe+V:Di8wMEKS6J7Zd5OM8rzNwJBV

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
440	3104	WerFault.exe	91

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3720 wrote to memory of 3104	3720	rundll32.exe	91
PID 3720 wrote to memory of 3104	3720	rundll32.exe	91
PID 3720 wrote to memory of 3104	3720	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b92180c63d76127643d4e56ea783abfd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b92180c63d76127643d4e56ea783abfd.dll,#1
  2⤵
  PID:3104
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3104 -s 660
    3⤵
    - Program crash
    PID:440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 3104 -ip 3104
1⤵
PID:4924

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3104-0-0x0000000002DE0000-0x0000000002E1E000-memory.dmp

Filesize
248KB

Download
memory/3104-1-0x0000000002DE0000-0x0000000002E1E000-memory.dmp

Filesize
248KB

Download
memory/3104-3-0x0000000028660000-0x000000002869E000-memory.dmp

Filesize
248KB

Download