603439f1badfee3690cdf828cd8a141efcec52ac57b7be4c7ebd076062c8e762 | Triage

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2024, 19:34

Sharing

Report Analysis Logs

General

Target

c16bf3b92ceb2896562ef9dc7cda3f77.dll
Size

548KB
MD5

c16bf3b92ceb2896562ef9dc7cda3f77
SHA1

2e690bb7a4991e51e32ccd848b0328e999586a98
SHA256

603439f1badfee3690cdf828cd8a141efcec52ac57b7be4c7ebd076062c8e762
SHA512

4892b9a5a19772fafa626767593e4aaadbd66a2978dffe32465b19027e8430f84f9c5aaa2469a58b61249364f7a0c3dd91b92c5599b02ad8f5536e46e7580954
SSDEEP

6144:1st18VF5g5g5g5g58st18VF5g5g5g5g5g5g58st18V:M8VN8VX8V

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
208	1424	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4540 wrote to memory of 1424	4540	rundll32.exe	87
PID 4540 wrote to memory of 1424	4540	rundll32.exe	87
PID 4540 wrote to memory of 1424	4540	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c16bf3b92ceb2896562ef9dc7cda3f77.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c16bf3b92ceb2896562ef9dc7cda3f77.dll,#1
  2⤵
  PID:1424
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1424 -s 612
    3⤵
    - Program crash
    PID:208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1424 -ip 1424
1⤵
PID:64

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads