36ea391cec988df62698d3099f31387b4df5502c64b54d78e3164ff2455c51c2 | Triage

Analysis

max time kernel
140s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-03-2024 09:22

Sharing

Report Analysis Logs

General

Target

Betacraft/libgcc_s_seh-1.dll
Size

73KB
MD5

a839c13c8fcd337a056d62a005a6aee7
SHA1

c9f8f6ca8becd7fad39017fd45c0b7835bedf173
SHA256

8660371ef7b69772138ef71f9077ae5c742b4a9b768ccca59263d20e8dec1815
SHA512

90751af770300c136245d0d5113a305876ab00ceb8968b14693082239ccacb091991e6b5d07599d9e3d9044a9ebfb92c3adfbf23f8754cc3024fde7cf17d81a1
SSDEEP

1536:7/p/osyPFN2WX2d0lH6MhDAgtB24GIOS2AiBx:b7yPfVHhTtxOS2R/

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 1168	1804	rundll32.exe	28
PID 1804 wrote to memory of 1168	1804	rundll32.exe	28
PID 1804 wrote to memory of 1168	1804	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Betacraft\libgcc_s_seh-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1804 -s 80
  2⤵
  PID:1168

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1804-0-0x000007FEFA940000-0x000007FEFA95A000-memory.dmp

Filesize
104KB

Download
memory/1804-1-0x0000000064940000-0x0000000064956000-memory.dmp

Filesize
88KB

Download