ce816088598bb98b6556479af9801fcfe8d817f18cc4b8ef12cf109310fa078f | Triage

Analysis

max time kernel
146s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2024, 14:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e1f0dba5bac1f1d4bb376e82232a2808.dll
Size

66KB
MD5

e1f0dba5bac1f1d4bb376e82232a2808
SHA1

b98040734bddc8b6412a7da132bdae4572fb7a5a
SHA256

ce816088598bb98b6556479af9801fcfe8d817f18cc4b8ef12cf109310fa078f
SHA512

a7ba2c0e4e290eb958f68e9ecf32e35ec809e45d112f05f423f1d290e8ae54696da923c74993d6a8c0d462c80938e7c1a457ad7d888ab54e48ed8b24d36960ef
SSDEEP

1536:NmWiB5tbTXIqM5w4tGq8g58KVL20u78+ZHZTl:oWctv8w4tGoruHZ/

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1076	3112	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 3112	4804	rundll32.exe	84
PID 4804 wrote to memory of 3112	4804	rundll32.exe	84
PID 4804 wrote to memory of 3112	4804	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e1f0dba5bac1f1d4bb376e82232a2808.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e1f0dba5bac1f1d4bb376e82232a2808.dll,#1
  2⤵
  PID:3112
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3112 -s 560
    3⤵
    - Program crash
    PID:1076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3112 -ip 3112
1⤵
PID:4844

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3112-0-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download