a6eb7a7372c462b2e181014540491a062c540edc4ba0f65a9169cfbfb473e6c7 | Triage

Analysis

max time kernel
45s
max time network
17s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/04/2024, 07:17

Sharing

Report Analysis Logs

General

Target

bin/uactmon.dll
Size

146KB
MD5

ffae295cc48606ba15fd9ac07c0c112f
SHA1

8c6f34204f8ac213b0fb90aa51ab21d52cbbbc29
SHA256

fad77b24478f5ec8aa7f6018e000cf504d6227fe217d1543d4b4cbe5f8a3b1ac
SHA512

ef4fcb39e9acabf7ebfd03249b99944e75331becd178b969ac9e12fbd94e8c123925a8a916166583f05e7dc5bbc4e0bd16e67d6e6a417d033349646b6c047e8e
SSDEEP

3072:L02zbMmVhON4Lk6EJiiV9RiItvpCpDuL/l5uoHm:Ln3MqIN4MVHiqsJuL/9Hm

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
380	2044	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 2044	2952	rundll32.exe	28
PID 2952 wrote to memory of 2044	2952	rundll32.exe	28
PID 2952 wrote to memory of 2044	2952	rundll32.exe	28
PID 2952 wrote to memory of 2044	2952	rundll32.exe	28
PID 2952 wrote to memory of 2044	2952	rundll32.exe	28
PID 2952 wrote to memory of 2044	2952	rundll32.exe	28
PID 2952 wrote to memory of 2044	2952	rundll32.exe	28
PID 2044 wrote to memory of 380	2044	rundll32.exe	29
PID 2044 wrote to memory of 380	2044	rundll32.exe	29
PID 2044 wrote to memory of 380	2044	rundll32.exe	29
PID 2044 wrote to memory of 380	2044	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\uactmon.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\uactmon.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2044
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 232
    3⤵
    - Program crash
    PID:380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads