Analysis

  • max time kernel
    93s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-04-2024 11:54

General

  • Target

    iconv.dll

  • Size

    32KB

  • MD5

    e1349d5e1238889819906f3e1fbe3b65

  • SHA1

    4099bbef8128ab2ce15767c2028169d89a69724e

  • SHA256

    f33efe8112f644383c0852e2232117f7b492264d74664bf70357666538c0b41d

  • SHA512

    5c725d32d17f7478a698e7b59e107e2ae0dd90ac1eccbf21cefacaa632d463149d9f221779ef01459c17bb3b4c2ea7eeaecf1b5ac251e961a4c9fed399cf6960

  • SSDEEP

    768:+4Hnnn9k2VhvWgUtAAfTspDHbMdiR2+Ga:+497V5UtDTsppY+Ga

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\iconv.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1928
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\iconv.dll,#1
      2⤵
        PID:516
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 516 -s 600
          3⤵
          • Program crash
          PID:4956
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 516 -ip 516
      1⤵
        PID:5100

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/516-0-0x0000000062780000-0x000000006278A000-memory.dmp

        Filesize

        40KB