8c8a90e3c41567dc8b18ba91308e0af5adc21ecc72b5ea75e3b5ba0ddd8a2e66 | Triage

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 19:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cc3551cfcf5ab4b003d2ad0ca1e8f1f6.dll
Size

158KB
MD5

cc3551cfcf5ab4b003d2ad0ca1e8f1f6
SHA1

b9586e84964b55a632c763fb7fc4571e2c416f96
SHA256

8c8a90e3c41567dc8b18ba91308e0af5adc21ecc72b5ea75e3b5ba0ddd8a2e66
SHA512

1c1dd5affa2545cd78606b08a8096b715dc02c936e70fe573bf89b375a0665c58ef44ff7019fcdacd98f1f7ced871c226b87dd845d33de91f05c3982c181ed1a
SSDEEP

3072:/c0LpqrzgYMEbgq9itcYqTP4r6e9PiScd:VLpYFrQtcHP4rB8Bd

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4976	2368	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5008 wrote to memory of 2368	5008	regsvr32.exe	88
PID 5008 wrote to memory of 2368	5008	regsvr32.exe	88
PID 5008 wrote to memory of 2368	5008	regsvr32.exe	88

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\cc3551cfcf5ab4b003d2ad0ca1e8f1f6.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\cc3551cfcf5ab4b003d2ad0ca1e8f1f6.dll
  2⤵
  PID:2368
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 600
    3⤵
    - Program crash
    PID:4976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2368 -ip 2368
1⤵
PID:4224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2368-0-0x0000000000550000-0x0000000000593000-memory.dmp

Filesize
268KB

Download