b75ff60aaccd7c025a5a2d27afc266bf23808cf46840a4bc868859f0902e09a8 | Triage

Analysis

max time kernel
150s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2024, 15:27

Sharing

Report Analysis Logs

General

Target

TwistedBrush/Image2PDF.dll
Size

772KB
MD5

15ba076becd1173837ae29a4fcd01d29
SHA1

67962430c4d4850962e2dffad160159a9f2a7776
SHA256

cecabe0f66119aa78da0c3386d084033a4ced3d8d869c1421af28f3b3b1b5d9a
SHA512

541f880c65fb03520d0fd71a156f62b8631520ec68ecac1dc916671a8d33bd6fc030b260187e5c39933a662aba415f0def76b4516529c898a13f607a9e89eb58
SSDEEP

24576:ge1ok43G+BcnksGisV+xRtPw7BrZhAkt:WVWiiG1t

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4648	4652	WerFault.exe	94

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 4652	1608	rundll32.exe	94
PID 1608 wrote to memory of 4652	1608	rundll32.exe	94
PID 1608 wrote to memory of 4652	1608	rundll32.exe	94

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\TwistedBrush\Image2PDF.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\TwistedBrush\Image2PDF.dll,#1
  2⤵
  PID:4652
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4652 -s 612
    3⤵
    - Program crash
    PID:4648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4652 -ip 4652
1⤵
PID:4440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4088 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8
1⤵
PID:4868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads