7595471a5408461166040f96c51a9f9b6d3e2f79d27c7bbd22d77a11ddbd48a9 | Triage

Analysis

max time kernel
146s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/04/2024, 14:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

EzSSSRes.dll
Size

783KB
MD5

44d73793b614e3cf648168e5ca40d7eb
SHA1

950993b8663b576fff2b71b93947b1dd9bd18227
SHA256

eaf39781414e77859552abba2b66124e4a62058aa3580a61231ad162dba22034
SHA512

50bc5764842ab52f69b9598a74bd74cf15d03aee8a814083915bef57f5eaa00ebf2382a0a151702be86c4af5369626ecf6f673c8da917e4514e38b85f660f966
SSDEEP

12288:rYj7o+QT7/IeQV2irpthiZsssj9WoUQlZRrg8EM3EPzymE2tJsj:rY/dQn/Pq2Qp2ZsbWVWPrdh3EPGmEoi

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5020	2656	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 2656	2960	rundll32.exe	83
PID 2960 wrote to memory of 2656	2960	rundll32.exe	83
PID 2960 wrote to memory of 2656	2960	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\EzSSSRes.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\EzSSSRes.dll,#1
  2⤵
  PID:2656
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 600
    3⤵
    - Program crash
    PID:5020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2656 -ip 2656
1⤵
PID:2956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2656-0-0x00000000021D0000-0x000000000229C000-memory.dmp

Filesize
816KB

Download
memory/2656-1-0x00000000021D0000-0x000000000229C000-memory.dmp

Filesize
816KB

Download