3eafdd2a558f1110606e4c95b5f2efac0536bb0005d5bd9f68957d3e866771c6 | Triage

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 22:21

Sharing

Report Analysis Logs

General

Target

Rapid.dll
Size

376KB
MD5

42c5ffe970aa12c10e5a45f837a033d9
SHA1

0b0d82cebe169768c892c7bbfcc0346db47da4a7
SHA256

3eafdd2a558f1110606e4c95b5f2efac0536bb0005d5bd9f68957d3e866771c6
SHA512

83de7c9638ac8e6ac2d34c87917dfc8aa309dfbec54e56b327384a47d959ce53207c2c214a2a42f44a6f9c524448f0cb405cbdcf9319f70a616da332dcaac0f5
SSDEEP

6144:Ill2N2/chkPSzWRVqLTb3TIDNmqf/xMzCeEpz2auh6Y7VtAeyp4/L:92/ZBMLTb3TIDNmvUz0L7JL

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3012	3984	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 3984	4552	rundll32.exe	86
PID 4552 wrote to memory of 3984	4552	rundll32.exe	86
PID 4552 wrote to memory of 3984	4552	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Rapid.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Rapid.dll,#1
  2⤵
  PID:3984
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3984 -s 600
    3⤵
    - Program crash
    PID:3012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3984 -ip 3984
1⤵
PID:2384

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads