406a23ff989e9ea29398993c0842f5a0202c3cffa54ef2fa21798767624d4719 | Triage

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16-03-2024 14:15

Sharing

Report Analysis Logs

General

Target

Fraps/data/Lib/Lib.dll
Size

137KB
MD5

8b5a4327dd67b631985471019c6229bc
SHA1

777c00d8a8569738ad6fb8e04eda26305adfe278
SHA256

393f97aae4086bf5f0b0384f21be82f72f402384f3cb2ed27466573e5706e94d
SHA512

01e428961720e6204aa4bb33ea04f153f670a0ec47e8b99cfbc94b2d8d7ba153bb17fdaeb5e4c6b14dd7e4b538ca5c980768e5208efab95bb8d53ecf3e7bd4d4
SSDEEP

3072:kX0BpBQhnSjU3li1eV6cYkAVHBP2zHTszIxXVD1L:RHKhnt341e5ooH0m1L

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3992	2576	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3708 wrote to memory of 2576	3708	rundll32.exe	87
PID 3708 wrote to memory of 2576	3708	rundll32.exe	87
PID 3708 wrote to memory of 2576	3708	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Fraps\data\Lib\Lib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3708
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Fraps\data\Lib\Lib.dll,#1
  2⤵
  PID:2576
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 552
    3⤵
    - Program crash
    PID:3992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2576 -ip 2576
1⤵
PID:4872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads