909df004857e854a646328179d73a9738eec6b2eb559be3b0cd8d3c53b3dd29a | Triage

Analysis

max time kernel
146s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-03-2024 05:06

Sharing

Report Analysis Logs

General

Target

Fix/AntiDllHiJack.dll
Size

101KB
MD5

4e530cb477269a470521c8de665cf705
SHA1

45c69eb4e32e8309d44742d7da9ebcb19575bb73
SHA256

76b512ab64995cbd6d965ca5ecc38d9ced67a1f9450da9e6f9ae1f5492068273
SHA512

2e0ac7f8664864e9e62c0ccf1eac68df8f0b8b536c4b5544ced4f8f0aa694dca3cedca42e7ee3d1e61c05ad7b1a9b6c147d66055ad71a7db0caf6559d5cac216
SSDEEP

1536:oiVNz8Ekk2yQ73ZiOsMz5kHOmtTT326FoQlAn2oxswg0wEn4O:9l8bk2yQ73Ldkuw3NlATg0Pnb

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
860	4472	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3708 wrote to memory of 4472	3708	rundll32.exe	87
PID 3708 wrote to memory of 4472	3708	rundll32.exe	87
PID 3708 wrote to memory of 4472	3708	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Fix\AntiDllHiJack.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3708
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Fix\AntiDllHiJack.dll,#1
  2⤵
  PID:4472
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4472 -s 608
    3⤵
    - Program crash
    PID:860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4472 -ip 4472
1⤵
PID:4088

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads