a6eb7a7372c462b2e181014540491a062c540edc4ba0f65a9169cfbfb473e6c7 | Triage

Analysis

max time kernel
91s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 07:17

Sharing

Report Analysis Logs

General

Target

bin/daemon.dll
Size

297KB
MD5

fe39e5e036b5c86ddb3ef2ada62ba0bf
SHA1

00adcabbca99ae74fda7794cc06af77d9cb3090c
SHA256

54fdaee273829f0b616a7aa61d8a1bc00b3f6e4b16c4c73b778ceffa5c5e47ba
SHA512

bdb6762be72b80d468af9b35c39608badc85184d5db2472acad87e3db496db044df4ba08730b9c7f5543d9f7753617683556786bdf63e6ded966bea86ca5afbf
SSDEEP

6144:V1aeIQpSVT0Upr7puka5WHKh0mF9Q77vaPTB7e5n3OuL/A5T:VOQpSS+r7puka5WY0mU7vaPTBe5n3jTW

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2124	1080	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 208 wrote to memory of 1080	208	rundll32.exe	84
PID 208 wrote to memory of 1080	208	rundll32.exe	84
PID 208 wrote to memory of 1080	208	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\daemon.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:208
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\daemon.dll,#1
  2⤵
  PID:1080
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1080 -s 640
    3⤵
    - Program crash
    PID:2124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1080 -ip 1080
1⤵
PID:1456

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads