2e8bc88df755f2a3fe6639fe58bf8384cb939d13f7769a8ffb029d3b0665d07b | Triage

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14-03-2024 19:40

Sharing

Report Analysis Logs

General

Target

fluorinepp.dll
Size

272KB
MD5

3b5383a664378c75505140991d2b5a94
SHA1

61295881c1ebab9eee95cd8c3c347afefbaae3d1
SHA256

bc266b83d3774920a9dac2313aafca2a510b67698217ae6af94aed45f4d0bd58
SHA512

2153cf4409abf913c8ba9e7da37fa229d6ad2672e403e7feb8176b7aaf536bc5d594098cfe916ebf6b2d3e9b443620406eabb573537d4261366e9e6982f0b9a6
SSDEEP

3072:IlklQ8pwtRrgJ5xMgeYrCEYXvEO+qPrJrtE9vyrsl0NGKZsbfNtFJuTICrs:0m+tSTM7EOvhDJrDslsZOJu8

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4940	4716	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 4716	2340	rundll32.exe	88
PID 2340 wrote to memory of 4716	2340	rundll32.exe	88
PID 2340 wrote to memory of 4716	2340	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fluorinepp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fluorinepp.dll,#1
  2⤵
  PID:4716
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4716 -s 612
    3⤵
    - Program crash
    PID:4940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4716 -ip 4716
1⤵
PID:3540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads