16e23671e95df4da9cd4dbd0316d0aed1412e728f3358862535f0ef668873bb1 | Triage

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2024, 17:32

Sharing

Report Analysis Logs

General

Target

bc65aa5cd4fa1b258fb6e83969418e31.dll
Size

80KB
MD5

bc65aa5cd4fa1b258fb6e83969418e31
SHA1

e3c0eeed7a08caf519e7fd37d569946232316357
SHA256

16e23671e95df4da9cd4dbd0316d0aed1412e728f3358862535f0ef668873bb1
SHA512

4181c8d78ed687fe58862600793f1a4cab60032999343530b1a5a27ad58e003737929643286f34b78cfd1014ff1cf0cd3bbe958845f5d6f6ab44c5675af9d46a
SSDEEP

768:1HcIs09x4jELmuIcKhSnCD2ANuJx98XrNBeNwI:KIs00jCmuLKkh9mBWw

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3264	1124	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 1124	2288	rundll32.exe	88
PID 2288 wrote to memory of 1124	2288	rundll32.exe	88
PID 2288 wrote to memory of 1124	2288	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bc65aa5cd4fa1b258fb6e83969418e31.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bc65aa5cd4fa1b258fb6e83969418e31.dll,#1
  2⤵
  PID:1124
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1124 -s 600
    3⤵
    - Program crash
    PID:3264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1124 -ip 1124
1⤵
PID:5112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads