a9699d8b6b67b7db7e0a465119bbd0034775243fbcd30d447fabc69ca609df8b | Triage

Analysis

max time kernel
143s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12-03-2024 11:03

Sharing

Report Analysis Logs

General

Target

c332768c6830c8f4dd356586a1c98eb7.dll
Size

256KB
MD5

c332768c6830c8f4dd356586a1c98eb7
SHA1

1988685d41b95a5203f5206de3a9cac7b3f9b646
SHA256

a9699d8b6b67b7db7e0a465119bbd0034775243fbcd30d447fabc69ca609df8b
SHA512

3e9cd8effb6cf4953a42a0b6b56460b5a90483f17758a49d10e8817d5b6566908acb575fe6255cda484d7a83ef90bb7ccf25abe92f710e73dfeb7748f11d8a85
SSDEEP

6144:592d9+N6JtNoRyDdoAU4eWUtGXOUyrpykECVEve:f89+Mta7AUCUtKta1ECVn

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2308	1380	WerFault.exe	94

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 1380	1128	rundll32.exe	94
PID 1128 wrote to memory of 1380	1128	rundll32.exe	94
PID 1128 wrote to memory of 1380	1128	rundll32.exe	94

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c332768c6830c8f4dd356586a1c98eb7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c332768c6830c8f4dd356586a1c98eb7.dll,#1
  2⤵
  PID:1380
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1380 -s 544
    3⤵
    - Program crash
    PID:2308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1380 -ip 1380
1⤵
PID:3256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3688 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
1⤵
PID:4568

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1380-0-0x0000000010000000-0x000000001005F000-memory.dmp

Filesize
380KB

Download