3b15085cfa2dfbbdfac9734b88d398301f75db88eecbb7da92ee931a8dfb1c11 | Triage

Analysis

max time kernel
159s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2024, 17:07

Sharing

Report Analysis Logs

General

Target

c92798f6c0f75b6b752febefad53e34e.dll
Size

72KB
MD5

c92798f6c0f75b6b752febefad53e34e
SHA1

cf65f895ad4a7289f6f0dac2f64ce5c3ef147559
SHA256

3b15085cfa2dfbbdfac9734b88d398301f75db88eecbb7da92ee931a8dfb1c11
SHA512

a39a32be28b0289d50eaf86a53eabf7cddc79efdf044c4d584074490286ef41b5c43874fdd9b295176e0e717a72165dc18a8e126b9ce015118160e09709b0c8a
SSDEEP

1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuv:C5UOq0ukgOK2l7aFQv

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1820	2352	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2352	2164	rundll32.exe	88
PID 2164 wrote to memory of 2352	2164	rundll32.exe	88
PID 2164 wrote to memory of 2352	2164	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c92798f6c0f75b6b752febefad53e34e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c92798f6c0f75b6b752febefad53e34e.dll,#1
  2⤵
  PID:2352
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2352 -s 600
    3⤵
    - Program crash
    PID:1820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2352 -ip 2352
1⤵
PID:1212

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads