73e28ced74454351ca285f40f6e225d7d2d1bd54c67b5a16223bb5007211fee9 | Triage

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2024, 07:21

Sharing

Report Analysis Logs

General

Target

be034b5f21eefb8dc8eaabcd35f612a2.dll
Size

1.9MB
MD5

be034b5f21eefb8dc8eaabcd35f612a2
SHA1

05f15790ad30fd334796a99ad2509424f881c51b
SHA256

73e28ced74454351ca285f40f6e225d7d2d1bd54c67b5a16223bb5007211fee9
SHA512

be9bf826814d315fc74d70af15ce73913c209ed9661cb5a9ffb9b1602b8e5d731c9df2b05728817b4b6256d5aff6d603ae4f9fb2db2ea72dc2badce898545459
SSDEEP

49152:Y/a794F4Tq230v1CqsHHYJmfmn+zjwQlQmo6:Yi79PAi4EfmnwcQlQY

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2792	412	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4028 wrote to memory of 412	4028	rundll32.exe	89
PID 4028 wrote to memory of 412	4028	rundll32.exe	89
PID 4028 wrote to memory of 412	4028	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\be034b5f21eefb8dc8eaabcd35f612a2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\be034b5f21eefb8dc8eaabcd35f612a2.dll,#1
  2⤵
  PID:412
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 412 -s 656
    3⤵
    - Program crash
    PID:2792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 412 -ip 412
1⤵
PID:4184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/412-0-0x0000000000F50000-0x0000000000F51000-memory.dmp

Filesize
4KB

Download