7595471a5408461166040f96c51a9f9b6d3e2f79d27c7bbd22d77a11ddbd48a9 | Triage

Analysis

max time kernel
140s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/04/2024, 14:51

Sharing

Report Analysis Logs

General

Target

EzSSSRes.dll
Size

783KB
MD5

44d73793b614e3cf648168e5ca40d7eb
SHA1

950993b8663b576fff2b71b93947b1dd9bd18227
SHA256

eaf39781414e77859552abba2b66124e4a62058aa3580a61231ad162dba22034
SHA512

50bc5764842ab52f69b9598a74bd74cf15d03aee8a814083915bef57f5eaa00ebf2382a0a151702be86c4af5369626ecf6f673c8da917e4514e38b85f660f966
SSDEEP

12288:rYj7o+QT7/IeQV2irpthiZsssj9WoUQlZRrg8EM3EPzymE2tJsj:rY/dQn/Pq2Qp2ZsbWVWPrdh3EPGmEoi

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
848	1524	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 1524	1556	rundll32.exe	28
PID 1556 wrote to memory of 1524	1556	rundll32.exe	28
PID 1556 wrote to memory of 1524	1556	rundll32.exe	28
PID 1556 wrote to memory of 1524	1556	rundll32.exe	28
PID 1556 wrote to memory of 1524	1556	rundll32.exe	28
PID 1556 wrote to memory of 1524	1556	rundll32.exe	28
PID 1556 wrote to memory of 1524	1556	rundll32.exe	28
PID 1524 wrote to memory of 848	1524	rundll32.exe	29
PID 1524 wrote to memory of 848	1524	rundll32.exe	29
PID 1524 wrote to memory of 848	1524	rundll32.exe	29
PID 1524 wrote to memory of 848	1524	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\EzSSSRes.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\EzSSSRes.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1524
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 228
    3⤵
    - Program crash
    PID:848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1524-0-0x00000000001A0000-0x000000000026C000-memory.dmp

Filesize
816KB

Download
memory/1524-1-0x00000000001A0000-0x000000000026C000-memory.dmp

Filesize
816KB

Download