bf9899cf48631a9ac8b75053a598dfae48753afd1901e39525bb6cd1b090771e | Triage

Analysis

max time kernel
148s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 15:10

Sharing

Report Analysis Logs

General

Target

d66d5cabd6c5b3cc9d5eeb4056b5eed5.dll
Size

6.2MB
MD5

d66d5cabd6c5b3cc9d5eeb4056b5eed5
SHA1

04ceb08e62d830b49d3ee18c4734c90fbfb0ee20
SHA256

bf9899cf48631a9ac8b75053a598dfae48753afd1901e39525bb6cd1b090771e
SHA512

117dc4900fad7b8953d6d879606ade23c6ed754c0e4fdb50f2a21ed705d382ed7dfcae9c73b9471b92c5f3306ba7bbfd6029b718ba129ca3fd3343e3763b70d6
SSDEEP

98304:F4aTQtpbmf4aTQtpbm94aTQtpbmT4aTQtpbm:acw1Rcw1Pcw1Fcw1

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
112	852	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 852	1044	rundll32.exe	90
PID 1044 wrote to memory of 852	1044	rundll32.exe	90
PID 1044 wrote to memory of 852	1044	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d66d5cabd6c5b3cc9d5eeb4056b5eed5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d66d5cabd6c5b3cc9d5eeb4056b5eed5.dll,#1
  2⤵
  PID:852
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 852 -s 600
    3⤵
    - Program crash
    PID:112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 852 -ip 852
1⤵
PID:2684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads