52b3a80c28a492eca1ce47570d5e443598944a050b194a5c5b46bb41457cf0a6 | Triage

Analysis

max time kernel
141s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/03/2024, 14:51

Sharing

Report Analysis Logs

General

Target

inj_ruoff.dll
Size

4KB
MD5

d3838b905c77075c9145cf27cbfd61ad
SHA1

dc008f432d6aebeb2bd15853c6687678f98e8815
SHA256

c95237dd7ee99d6c844702f46f032d0cb2ca19ba212cb091e6bc268b54e6c1bb
SHA512

29210f5a6976f1f169d0d18a081c20ef328600b0a64a93b464502a0878cf135275b47ffe9f21eaecea16a3ef6369fb67d6a06896b6e838a9a18307dcd7790cbf
SSDEEP

24:etGSJVmUMvuTdDEVjQ0y19IfWIRDnPe1XF1k0n7PbSbCUVX21Shp5O:6JVSuq1yeR7G111k0n7ACUVGo

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2664	1732	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 1732	1964	rundll32.exe	28
PID 1964 wrote to memory of 1732	1964	rundll32.exe	28
PID 1964 wrote to memory of 1732	1964	rundll32.exe	28
PID 1964 wrote to memory of 1732	1964	rundll32.exe	28
PID 1964 wrote to memory of 1732	1964	rundll32.exe	28
PID 1964 wrote to memory of 1732	1964	rundll32.exe	28
PID 1964 wrote to memory of 1732	1964	rundll32.exe	28
PID 1732 wrote to memory of 2664	1732	rundll32.exe	29
PID 1732 wrote to memory of 2664	1732	rundll32.exe	29
PID 1732 wrote to memory of 2664	1732	rundll32.exe	29
PID 1732 wrote to memory of 2664	1732	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\inj_ruoff.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\inj_ruoff.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1732
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 228
    3⤵
    - Program crash
    PID:2664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1732-0-0x000000006F840000-0x000000006F848000-memory.dmp

Filesize
32KB

Download
memory/1732-1-0x000000006F840000-0x000000006F848000-memory.dmp

Filesize
32KB

Download