9933d8c7cccf4d90726b11a933c9eca8ae1cd070e71ec9819cfbe0148e4a7c34 | Triage

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2024, 02:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bd6c7225e0a7aaddb4a55d2fa84dcc0c.dll
Size

57KB
MD5

bd6c7225e0a7aaddb4a55d2fa84dcc0c
SHA1

26b28656985ee3781f984ae053e3a18bebb51bc4
SHA256

9933d8c7cccf4d90726b11a933c9eca8ae1cd070e71ec9819cfbe0148e4a7c34
SHA512

7e862091178b56ce0e3035c64cbed003c29f78786e71f53067caaf6b58a597628d0a75a773ad24776e79af1026ec92105a848a0ccdae741f522e9c543742395b
SSDEEP

1536:rdi7YNHNUUAJa5zCfqGcW1UTFDPaQiKmLZx0hi:rdi71UAszPG51EFDmLZxJ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1756	2340	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 2340	1596	rundll32.exe	90
PID 1596 wrote to memory of 2340	1596	rundll32.exe	90
PID 1596 wrote to memory of 2340	1596	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd6c7225e0a7aaddb4a55d2fa84dcc0c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd6c7225e0a7aaddb4a55d2fa84dcc0c.dll,#1
  2⤵
  PID:2340
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 652
    3⤵
    - Program crash
    PID:1756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2340 -ip 2340
1⤵
PID:4428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2340-0-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download
memory/2340-1-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download