e4c23a84e7669a547b5cbbd1c3dd896ed887f26656ba1de0455503ee7fbab075 | Triage

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2024, 01:22

Sharing

Report Analysis Logs

General

Target

bf7919c6aebe2f293124b0d0adc585d0.dll
Size

195KB
MD5

bf7919c6aebe2f293124b0d0adc585d0
SHA1

bfff0223abd6ba8ad889eb9bab7e4964f4175a2c
SHA256

e4c23a84e7669a547b5cbbd1c3dd896ed887f26656ba1de0455503ee7fbab075
SHA512

35d0add86f635d7ed4c4884dbd83fb8d4ae520f945027b64cd2af1d07bab7e468df8ebc34effc169e9d9db7a22b6986016099b32829215241f4671c5121c8433
SSDEEP

6144:8U3XJj86Q6hWrfkXmDPpe2HoUgtr32iHIlXDs/UrG:F3X/hfc428r32iHAX8Uq

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4664	224	WerFault.exe	94

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4272 wrote to memory of 224	4272	rundll32.exe	94
PID 4272 wrote to memory of 224	4272	rundll32.exe	94
PID 4272 wrote to memory of 224	4272	rundll32.exe	94

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bf7919c6aebe2f293124b0d0adc585d0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bf7919c6aebe2f293124b0d0adc585d0.dll,#1
  2⤵
  PID:224
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 708
    3⤵
    - Program crash
    PID:4664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 224 -ip 224
1⤵
PID:1776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3928 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8
1⤵
PID:3188

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/224-0-0x0000000000BB0000-0x0000000000C6A000-memory.dmp

Filesize
744KB

Download
memory/224-1-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Filesize
4KB

Download
memory/224-2-0x0000000000BB0000-0x0000000000C6A000-memory.dmp

Filesize
744KB

Download