909df004857e854a646328179d73a9738eec6b2eb559be3b0cd8d3c53b3dd29a | Triage

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2024, 05:06

Sharing

Report Analysis Logs

General

Target

Dyn/Tc2Killer.dll
Size

53KB
MD5

577eab3292de450614a90c29e2cfd070
SHA1

81c4f7f3b49adfcd64d0604958e07520278ad2ab
SHA256

3fe9c0fd059595d4b2ec07bc2692024ef9dfa351345b73e147b680d08f49ad9d
SHA512

8f8de3617431ec8ec1fc73c8f9ed5b21544f6e49a12d79beb2899294d6be56482c257e9682bb48b5cd478da82321be99648c9ee43775b666b704a635482f0edf
SSDEEP

768:o/7qTTPT3YGstKiilxsmcfATRNVb3lx8TkjBn4LZl6:qWPT34KlxhcoTZlx8TkNn4W

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2172	228	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3924 wrote to memory of 228	3924	rundll32.exe	88
PID 3924 wrote to memory of 228	3924	rundll32.exe	88
PID 3924 wrote to memory of 228	3924	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dyn\Tc2Killer.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dyn\Tc2Killer.dll,#1
  2⤵
  PID:228
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 600
    3⤵
    - Program crash
    PID:2172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 228 -ip 228
1⤵
PID:220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads