5ac959e5dee9884512f4a34623bbad2c08be427669015b917a750f7cbfbb0a75 | Triage

Analysis

max time kernel
94s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15/04/2024, 16:14

Sharing

Report Analysis Logs

General

Target

Rainmeter.dll
Size

1.9MB
MD5

a65154d1508aab4e6b955d9e8b66266c
SHA1

8ee71e0772163c1aefaed93728723e7afc493361
SHA256

b581e431f1dfe1f11a85af976c6ff635f596789572313a845c84d10537513f1d
SHA512

52943c031c5c5d19b0f40e1b81eb054a7a09247627929fca4015fc5c07265d1cfa097e06cb27c27fad59c92e2c6035471fd63ec3ded919dd649a8bc227030fd8
SSDEEP

49152:bOwTzxjWIHYwholKwzSGlV8OP7yE20gevptppYIWxi7nG/r0L3M7u:bDxjW3lKwzSGnny550L7

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1968	3640	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 3640	4368	rundll32.exe	85
PID 4368 wrote to memory of 3640	4368	rundll32.exe	85
PID 4368 wrote to memory of 3640	4368	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Rainmeter.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Rainmeter.dll,#1
  2⤵
  PID:3640
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3640 -s 696
    3⤵
    - Program crash
    PID:1968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3640 -ip 3640
1⤵
PID:2628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads