66e9f4d03e67dbcbd9d3a13bfc45b2c11e712b677e990e8ea1b405b60a3a40b2 | Triage

Analysis

max time kernel
1762s
max time network
1172s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2024, 09:34

Sharing

Report Analysis Logs

General

Target

Resources/LoadRAW.dll
Size

282KB
MD5

181b60fbe5056011193406ed2b6547c4
SHA1

2ffa3cf54287c5b5648470458b0fd0d10a16a46a
SHA256

4271e84125afd5c4d2e29a5b196526aa6937080efc6678127523f8b28eb3cf36
SHA512

18229713ade42aca9b600bd9ddd3bd13ae9b46d8d5c0ee9e02ae4a86037fbd0033182cb4a5f92c0fd48bc48f210edf69166c0f80b2550eb9c6d796f7accf6d8d
SSDEEP

6144:cyzfnLgzZra8HkJ3JVYSsjZSkHW7ZX1TtTP44bqHpR:vfMzZrW4SEH0XBtTP4gqH3

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2192	896	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 896	4580	rundll32.exe	90
PID 4580 wrote to memory of 896	4580	rundll32.exe	90
PID 4580 wrote to memory of 896	4580	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Resources\LoadRAW.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Resources\LoadRAW.dll,#1
  2⤵
  PID:896
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 896 -s 612
    3⤵
    - Program crash
    PID:2192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 896 -ip 896
1⤵
PID:1480

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads