9a33ff3deea984165327d7334e3cffa8df23aebcc1d1c0aa144044a52df35421 | Triage

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 09:52

Sharing

Report Analysis Logs

General

Target

SearchPanel.dll
Size

258KB
MD5

29fceeb4df481c034578d6366bd1550f
SHA1

8b40b762f778fb796c6c0b246125e07660e98901
SHA256

4cf3bb6cd8a3866bfab663543ba0bd59978cd9adb60d5f2f8096156a30abb65d
SHA512

69ab5f24e6789cf7425dad39f302aa39ba14a60f981e1ce18d1f2aa0b162945c11c9b187b52d458e4068246aa0d9f53a0df78b78cc71702d6119c5c748feed77
SSDEEP

6144:ai9NTNMuz8nPTkgMqL01/y0vG8DWOdWH4b5:aiPSuzc01KN8yob5

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3528	1784	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1356 wrote to memory of 1784	1356	rundll32.exe	83
PID 1356 wrote to memory of 1784	1356	rundll32.exe	83
PID 1356 wrote to memory of 1784	1356	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SearchPanel.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1356
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SearchPanel.dll,#1
  2⤵
  PID:1784
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 620
    3⤵
    - Program crash
    PID:3528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1784 -ip 1784
1⤵
PID:1888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads