75b3c03b9e446ffe9417f6035b8334afc95d2f7a1d093df1c3aadfe024f4b92a | Triage

Analysis

max time kernel
138s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2024, 07:45

Sharing

Report Analysis Logs

General

Target

bin/libgcrypt-11.dll
Size

463KB
MD5

6d98aff645bb5fdc525cb0d207b7c762
SHA1

af3efb481a343d4349bd7e96c12043a978454689
SHA256

34610c67ab6dd12cd33e21453f330be6ef38aec943beccb2b0719737dd6e555a
SHA512

07079205f81c1ab70f78f5d78dac6c7ba94a9294bce77eec6e78d3c7920dcd7ba63a96b067761f727942afdcd348ca75ea24e23777497600c81a924dea7c4d92
SSDEEP

12288:/AIZHvtdsGV8SLl7CCSck6ef5H1bwyB+koIq0I64:/1WAVa5VbT1oI/I9

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4652	2128	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2128	2152	rundll32.exe	89
PID 2152 wrote to memory of 2128	2152	rundll32.exe	89
PID 2152 wrote to memory of 2128	2152	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\libgcrypt-11.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\libgcrypt-11.dll,#1
  2⤵
  PID:2128
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 620
    3⤵
    - Program crash
    PID:4652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2128 -ip 2128
1⤵
PID:2420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2128-0-0x00000000007A0000-0x00000000007B3000-memory.dmp

Filesize
76KB

Download
memory/2128-2-0x00000000007A0000-0x00000000007B3000-memory.dmp

Filesize
76KB

Download