909df004857e854a646328179d73a9738eec6b2eb559be3b0cd8d3c53b3dd29a | Triage

Analysis

max time kernel
138s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2024, 05:06

Sharing

Report Analysis Logs

General

Target

Fix/360Verify.dll
Size

93KB
MD5

a8b29ba422db955c546580cf1207e75f
SHA1

261f5be755b1d18a42d0b18543dd01d731a661e9
SHA256

17b52b86c733e14ce7aeb40fdad9c123043abc37e0671111fd4f2bc4b5a5d089
SHA512

efbb2186d7d98013a5b50331e98e0104900676edae67cf0b44dbc80a400d62953fa6d8d95bd1175d7503113a91e503a49931b479ddeaf55657b8c4e087c920f8
SSDEEP

1536:I7XTU9u6hlfpKi0WLiT0F705JnG0J2htn2o2lfbe/n403:IPUI6hFnfaGR2o2lD2nD3

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2908	784	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4484 wrote to memory of 784	4484	rundll32.exe	88
PID 4484 wrote to memory of 784	4484	rundll32.exe	88
PID 4484 wrote to memory of 784	4484	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Fix\360Verify.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Fix\360Verify.dll,#1
  2⤵
  PID:784
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 784 -s 644
    3⤵
    - Program crash
    PID:2908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 784 -ip 784
1⤵
PID:4404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads