b779944b6ec7094524fa093f47c9a3849586986899d790e8956c70e6195a7159 | Triage

Analysis

max time kernel
144s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25/03/2024, 16:10

Sharing

Report Analysis Logs

General

Target

de69a72b4e091ee8666ddd1510502f46.dll
Size

40KB
MD5

de69a72b4e091ee8666ddd1510502f46
SHA1

9a5da48ef6fa37e5820d8af426ff0e98d69627da
SHA256

b779944b6ec7094524fa093f47c9a3849586986899d790e8956c70e6195a7159
SHA512

95be66afdba4843d6ed8ab99c5c20d3f0089bab8dc99a113a704a8f8be6a37921f7f0895db4dbd09d73e776858ca67acaf34f2b71ac57d51edf39f8b220dde00
SSDEEP

768:ThjyjmUUYhNWN38De/0K6mcQLhERid9DC:8mUUBmsjLhFC

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4856	2880	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 2880	2940	rundll32.exe	89
PID 2940 wrote to memory of 2880	2940	rundll32.exe	89
PID 2940 wrote to memory of 2880	2940	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\de69a72b4e091ee8666ddd1510502f46.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\de69a72b4e091ee8666ddd1510502f46.dll,#1
  2⤵
  PID:2880
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 616
    3⤵
    - Program crash
    PID:4856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2880 -ip 2880
1⤵
PID:820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads