4969529f962c7cbbb1c368b92dd2f99131c3ad6e5a12919b8aee8b47c92beacf | Triage

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-03-2024 11:50

Sharing

Report Analysis Logs

General

Target

breakpad.dll
Size

172KB
MD5

49b6c7dcac177701058dc1d2f91b0dc2
SHA1

9023fbeed8d705f59fc009f930e4b392008cb594
SHA256

79e48d9d160ac433235c3a350c5baf79b2eefc26c2d3ac2d2207ffab716b540d
SHA512

e097cfa5406ebd938428a77b4e4ff745186f6719f0af05027a4bec943a755b61888f099e8c8d732cd1c528c50f1d9d79b86383a73f0dea213d56815e7470e46a
SSDEEP

3072:ygLrmgUuiRhQZiGU5PxfeG3UytoywwJaZaXn/rxrtOUqo:ygLSfuifQYGSJ2G3U9ywlZWmf

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 628	1772	rundll32.exe	28
PID 1772 wrote to memory of 628	1772	rundll32.exe	28
PID 1772 wrote to memory of 628	1772	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\breakpad.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1772 -s 84
  2⤵
  PID:628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads