52b3a80c28a492eca1ce47570d5e443598944a050b194a5c5b46bb41457cf0a6 | Triage

Analysis

max time kernel
141s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18-03-2024 14:51

Sharing

Report Analysis Logs

General

Target

inj_ruoff.dll
Size

4KB
MD5

d3838b905c77075c9145cf27cbfd61ad
SHA1

dc008f432d6aebeb2bd15853c6687678f98e8815
SHA256

c95237dd7ee99d6c844702f46f032d0cb2ca19ba212cb091e6bc268b54e6c1bb
SHA512

29210f5a6976f1f169d0d18a081c20ef328600b0a64a93b464502a0878cf135275b47ffe9f21eaecea16a3ef6369fb67d6a06896b6e838a9a18307dcd7790cbf
SSDEEP

24:etGSJVmUMvuTdDEVjQ0y19IfWIRDnPe1XF1k0n7PbSbCUVX21Shp5O:6JVSuq1yeR7G111k0n7ACUVGo

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3468	2676	WerFault.exe	96

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 2676	1416	rundll32.exe	96
PID 1416 wrote to memory of 2676	1416	rundll32.exe	96
PID 1416 wrote to memory of 2676	1416	rundll32.exe	96

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\inj_ruoff.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\inj_ruoff.dll,#1
  2⤵
  PID:2676
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2676 -s 620
    3⤵
    - Program crash
    PID:3468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2676 -ip 2676
1⤵
PID:908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3964 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8
1⤵
PID:4600

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2676-0-0x000000006F840000-0x000000006F848000-memory.dmp

Filesize
32KB

Download
memory/2676-1-0x000000006F840000-0x000000006F848000-memory.dmp

Filesize
32KB

Download