e97395b4e113fa33edef35bec36db5c796c089cc814006e75b7ac632a79b943d | Triage

Analysis

max time kernel
16s
max time network
30s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-04-2024 05:35

Sharing

Report Analysis Logs

General

Target

sk4d.dll
Size

18.1MB
MD5

682e19aa868f6573b7e6735cf3875666
SHA1

36dd8af17da735d4482902e9e5548d4791f42330
SHA256

e97395b4e113fa33edef35bec36db5c796c089cc814006e75b7ac632a79b943d
SHA512

62483d168763a7a4d54694e5985be099ab501c67d02412eec149384c2453cd31b0eb19f6a18d1c6a9edf10bd153e8d9985a08a6b511d85f5155ee88a1efc291e
SSDEEP

393216:PKKDJ0MiunIO5BJ2YKlQ3TliXUxR0rHa93WhlU6t5:1FiuI+MQ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2024	2620	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 2620	2788	rundll32.exe	30
PID 2788 wrote to memory of 2620	2788	rundll32.exe	30
PID 2788 wrote to memory of 2620	2788	rundll32.exe	30
PID 2788 wrote to memory of 2620	2788	rundll32.exe	30
PID 2788 wrote to memory of 2620	2788	rundll32.exe	30
PID 2788 wrote to memory of 2620	2788	rundll32.exe	30
PID 2788 wrote to memory of 2620	2788	rundll32.exe	30
PID 2620 wrote to memory of 2024	2620	rundll32.exe	31
PID 2620 wrote to memory of 2024	2620	rundll32.exe	31
PID 2620 wrote to memory of 2024	2620	rundll32.exe	31
PID 2620 wrote to memory of 2024	2620	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\sk4d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\sk4d.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 248
    3⤵
    - Program crash
    PID:2024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads