21e431d36e4c3100b886e644d544d7e4458a83322dd7d15257e1badc95af83a9 | Triage

Analysis

max time kernel
92s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 02:00

Sharing

Report Analysis Logs

General

Target

avizlib.dll
Size

112KB
MD5

2f1cc76bbcf6d77d40d0e23392fa8eda
SHA1

624f0b44234f0bb4ef6290c508153dff1c4dbc6c
SHA256

04ee6ec0250d67f30cadfabbbc45edc4e13d849e0f80b0e635d6e2988c0d8644
SHA512

f9b35592172cff16dcbb72a4b31ae536450b19273618ac69830d23d48d17014bf903ad39ff2ab840cbdbf3868ad0eb9f591fa8006a66330ac99461a1a7fc8d29
SSDEEP

1536:pW+2jYWXHYSqad1GuoydAJfJW9T/bPAfDalgQOoz:pHSpozJJWZyDalJOo

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4060	2704	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 2704	1812	rundll32.exe	84
PID 1812 wrote to memory of 2704	1812	rundll32.exe	84
PID 1812 wrote to memory of 2704	1812	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\avizlib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\avizlib.dll,#1
  2⤵
  PID:2704
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 628
    3⤵
    - Program crash
    PID:4060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2704 -ip 2704
1⤵
PID:2196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads