bd609bfe3138d11c3c3afc2e7aa5543592ffb7a67e592ab51f010d04d29f65b4 | Triage

Analysis

max time kernel
154s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2024, 04:22

Sharing

Report Analysis Logs

General

Target

e0c2b2f5e646fa0aabf16dde266b6d34.dll
Size

100KB
MD5

e0c2b2f5e646fa0aabf16dde266b6d34
SHA1

bee3e6aa778ac8b61d3d0182b746b512d4d949f2
SHA256

bd609bfe3138d11c3c3afc2e7aa5543592ffb7a67e592ab51f010d04d29f65b4
SHA512

fb4de1bc04eb3c2c0ce9287c06c718224b98afd8e4dd76a7b1db3e772575d056df98d40b9755600ca68af495a5a62a5d4ee7a0703936e8614cafe179cd26d0df
SSDEEP

3072:rgZbSe2TKh0vh51CXTQ7bqcP1yigAzUagYuIn9ql:rgZW9wXslIa+

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
536	2252	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4744 wrote to memory of 2252	4744	rundll32.exe	87
PID 4744 wrote to memory of 2252	4744	rundll32.exe	87
PID 4744 wrote to memory of 2252	4744	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e0c2b2f5e646fa0aabf16dde266b6d34.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e0c2b2f5e646fa0aabf16dde266b6d34.dll,#1
  2⤵
  PID:2252
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 636
    3⤵
    - Program crash
    PID:536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2252 -ip 2252
1⤵
PID:1668

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2252-0-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download