bdaa68c205c48d9aba0f2fd9149a2b18d980b79d2ba0b79522d67fa86729c76f | Triage

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15-03-2024 09:49

Sharing

Report Analysis Logs

General

Target

cb18f18d4299584426a0fe3b19903ea5.dll
Size

3.4MB
MD5

cb18f18d4299584426a0fe3b19903ea5
SHA1

4934f0d2848c257d4b7e80a462cf50bda2ecaa93
SHA256

bdaa68c205c48d9aba0f2fd9149a2b18d980b79d2ba0b79522d67fa86729c76f
SHA512

3ff4c08892f74d2e95f67483d46506a4182654a30a2fe76719b82d4774a5b7a9a120c9cab80e25037217e33c50f086077b7bbe958f412082e2aafa5d756521bc
SSDEEP

49152:WVwEWxNIjbKKMVwEWxNIjbKKKKMVwEWxNIj:HEWxmEWxIEWx

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1488	3296	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3912 wrote to memory of 3296	3912	rundll32.exe	83
PID 3912 wrote to memory of 3296	3912	rundll32.exe	83
PID 3912 wrote to memory of 3296	3912	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb18f18d4299584426a0fe3b19903ea5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3912
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb18f18d4299584426a0fe3b19903ea5.dll,#1
  2⤵
  PID:3296
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3296 -s 600
    3⤵
    - Program crash
    PID:1488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3296 -ip 3296
1⤵
PID:1332

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads