784dddd1bcf75a42e40d9af9642170b7f0d2ace371b3262dcd6fd8f21b5f32ce | Triage

Analysis

max time kernel
137s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15-03-2024 20:03

Sharing

Report Analysis Logs

General

Target

ASI130MM.dll
Size

122KB
MD5

f5a652c24d790c52136e381e1420c105
SHA1

f8850e2a4532a0f3e6f8213bce3e7fa4935f9e5f
SHA256

10a866d0fe5d2b12d6d6f07131c1608e2ee14d5306b7e36d69a1cf71f11bc93b
SHA512

ddb85e3f61fc23daea9058aadee0860dcc87ba2e1272fb978a64d75fb669d4925eb3caf431400fd917203c795a79e1d6c24300f1b95abb984557dcd2c084a376
SSDEEP

1536:l5mcBBLfRUAQmk4XmUoaKs0zU23kJdl4epDvtmgMbFucIRhMc:7msLmPJdtWp4etAg0FucIRhM

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5076	2860	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4396 wrote to memory of 2860	4396	rundll32.exe	89
PID 4396 wrote to memory of 2860	4396	rundll32.exe	89
PID 4396 wrote to memory of 2860	4396	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ASI130MM.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ASI130MM.dll,#1
  2⤵
  PID:2860
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 616
    3⤵
    - Program crash
    PID:5076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2860 -ip 2860
1⤵
PID:4168

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads