5b3382faf060e55b994fb6fb9adc023b75ead723e0213c64fabd22a65f59e88c | Triage

Analysis

max time kernel
1s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
29-03-2024 14:07

Sharing

Report Analysis Logs

General

Target

g2m.dll
Size

399KB
MD5

40a87fac95b1fee45a6660d56fe67930
SHA1

9f7a6a9f30885607d66d0d12c422d4ecf668fc6c
SHA256

52cceb7014050cfcecc7c10c7ea067b20c26dbf33cec0a9cef88cbddcb048836
SHA512

13d8661cd3357057ab8ae1fd01e32cec925b4451fa1068932b5227f82a3b0b15adc12ed260d03f3e376ccea680c23165e8ca67904534ca1ecc3f5795e5d77380
SSDEEP

6144:c1PrHGV3QVKxsytQJBxeMmQspEPhsGa3JB7UgG6H:c1PyV3AevQeEPhbiS

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4052	4752	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 4752	2276	rundll32.exe	79
PID 2276 wrote to memory of 4752	2276	rundll32.exe	79
PID 2276 wrote to memory of 4752	2276	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\g2m.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\g2m.dll,#1
  2⤵
  PID:4752
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 420
    3⤵
    - Program crash
    PID:4052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4752 -ip 4752
1⤵
PID:3880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads