ed954020141bf0ccb7deaa028886b89657e6a4bd6c5b55fd006a9e13df7728e6 | Triage

Analysis

max time kernel
137s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 12:42

Sharing

Report Analysis Logs

General

Target

d625002a5312b6b6bfd1ad9116d9a301.dll
Size

134KB
MD5

d625002a5312b6b6bfd1ad9116d9a301
SHA1

75a3b39b1e66bced13fc699cf5a297cca5b9d681
SHA256

ed954020141bf0ccb7deaa028886b89657e6a4bd6c5b55fd006a9e13df7728e6
SHA512

1e3cac41d1fb0a1b938a9abdcd46e047d36955e59942fe1a6911c9a399e976d3817be1c49043c67715d488e4398982c344b18a7ee1834a4b4be9355a21194abe
SSDEEP

1536:FA7unarNJ76SD0Z8MhhniE5ahGTpStgAwDGBoJYiMZ:AjTExFEhGdSh+GB+MZ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4284	220	WerFault.exe	95

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 220	2188	rundll32.exe	95
PID 2188 wrote to memory of 220	2188	rundll32.exe	95
PID 2188 wrote to memory of 220	2188	rundll32.exe	95

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d625002a5312b6b6bfd1ad9116d9a301.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d625002a5312b6b6bfd1ad9116d9a301.dll,#1
  2⤵
  PID:220
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 220 -s 548
    3⤵
    - Program crash
    PID:4284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 220 -ip 220
1⤵
PID:4232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4012 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:2420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/220-0-0x0000000010000000-0x0000000010036000-memory.dmp

Filesize
216KB

Download