909df004857e854a646328179d73a9738eec6b2eb559be3b0cd8d3c53b3dd29a | Triage

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2024, 05:06

Sharing

Report Analysis Logs

General

Target

Dyn/MtKiller.dll
Size

53KB
MD5

71a18d9f961c9db73f7ae4be8dba71f5
SHA1

58d5b7dca3b02b59d8ebf023d3eb9e50c4d14eb4
SHA256

02a1f0690a3ec9ca33c9295ca8130f6e03955169211ac4b1c67d37a888d03b0d
SHA512

c775fed65293a2adcec026ff30f5f33a0b3064a0930fb6d9c07924fc509815867e018ae11a7491a9524b2587b4890b0f6d91de4fb81c35a5227ed70c1dab278f
SSDEEP

768:4Gx0324Tk6fTJx8YBFMLv5VSbAixsxldqc9NEDbn4LZHw8:E24Tk67JJFK3WoldfEnn4S8

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1568	3800	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 3800	1608	rundll32.exe	88
PID 1608 wrote to memory of 3800	1608	rundll32.exe	88
PID 1608 wrote to memory of 3800	1608	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dyn\MtKiller.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dyn\MtKiller.dll,#1
  2⤵
  PID:3800
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3800 -s 600
    3⤵
    - Program crash
    PID:1568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3800 -ip 3800
1⤵
PID:3592

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads