023129859f01fffa64c623b8cee78e704b7f82cb00f71ba38e2e1fd6586517b2 | Triage

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/04/2024, 17:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

common.dll
Size

2.5MB
MD5

c5a8d53cdc4dd278216f9e96bd43b320
SHA1

e5b4ec59e29d109a6c26c42156ae1e2f7762d469
SHA256

44b470982a4ee8ca1f98d647265b8dcb21979f8df8ed74db3e7cc24f88cfb67e
SHA512

4fed2a7ebad99a585e07e3e938f62fb887a046d03484df2918ba113a07d5dd587eefcb2360bf4736e1075629f85880cc6ad7ae6f0b7e0c70798be5358911e862
SSDEEP

49152:mc+q8brZSAZ2ZezFMJz1t/t8O/DxGSb8lpmcwjT9UQao11KvdhG/:m7+8iT8OYSHfB

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2356	2352	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 2352	1680	rundll32.exe	28
PID 1680 wrote to memory of 2352	1680	rundll32.exe	28
PID 1680 wrote to memory of 2352	1680	rundll32.exe	28
PID 1680 wrote to memory of 2352	1680	rundll32.exe	28
PID 1680 wrote to memory of 2352	1680	rundll32.exe	28
PID 1680 wrote to memory of 2352	1680	rundll32.exe	28
PID 1680 wrote to memory of 2352	1680	rundll32.exe	28
PID 2352 wrote to memory of 2356	2352	rundll32.exe	29
PID 2352 wrote to memory of 2356	2352	rundll32.exe	29
PID 2352 wrote to memory of 2356	2352	rundll32.exe	29
PID 2352 wrote to memory of 2356	2352	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\common.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\common.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2352
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2352 -s 248
    3⤵
    - Program crash
    PID:2356

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads