583feea06538dafdcb84c84722b337bf945259c0d1cb9d1e5773e4b81d1638f4 | Triage

Analysis

max time kernel
149s
max time network
159s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
13-03-2024 05:29

Sharing

Report Analysis Logs

General

Target

lapack_win32.dll
Size

3.7MB
MD5

0ad0ae2ebfa4ebeef917bbb7a1de028b
SHA1

a995c87707a5dc2b3cbbd0644c7a68ebce5d84c2
SHA256

3f4ce674e73b654aeb08ff10694a3baaea4c0774b3f75b08ff8de970801fdb0f
SHA512

0b7103bcc654ba36b1ce7ba932e892a0e95bc52ae52c472d22d32e6857c560fce10cbf2c78376201fd2d79ed4f7dcac46d692f25b8131fc813a97baf25d279a9
SSDEEP

49152:u26a5XijluuHe+D5bDdt5Sa+dtCcdQCWdlNgCyPzfMZVpa55elvy7cCPHyDW4sYJ:V5GDmyd2j067rShv

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1348	4156	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 4156	2156	rundll32.exe	81
PID 2156 wrote to memory of 4156	2156	rundll32.exe	81
PID 2156 wrote to memory of 4156	2156	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\lapack_win32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\lapack_win32.dll,#1
  2⤵
  PID:4156
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4156 -s 452
    3⤵
    - Program crash
    PID:1348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 4156 -ip 4156
1⤵
PID:4816

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4156-0-0x00000000008E0000-0x000000000098B000-memory.dmp

Filesize
684KB

Download