8244d3c049d38b92198166cd4f16d6a77f67c731fd157683c25decf4e699867e | Triage

Analysis

max time kernel
84s
max time network
204s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
16/04/2024, 19:36

Sharing

Report Analysis Logs

General

Target

dragon_s.dll
Size

172.2MB
MD5

80a8a2ae9f0f6eac1c525df97c67b590
SHA1

d54771fb72f2b66214a35dc6e3d2c0d5ea3e4383
SHA256

affae89dfdbbb18ef4c0a1a870830cdddd423e60fc72a42bb987ae56df514a00
SHA512

3f1509b1e357deedfa7a5a581f52c6c2044d5c36da6908f19816613be309b154b1a17577c2c6260a672eb186d826c5d3a60dc14c18614ff3f1b24a17489fc9e5
SSDEEP

3145728:QEp6Ccl8pSGZeyDFtr6PLK617pE3ZJ+90Ho:QEECsxGZeyOK47CZJG0I

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1548	4508	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 4508	4964	rundll32.exe	79
PID 4964 wrote to memory of 4508	4964	rundll32.exe	79
PID 4964 wrote to memory of 4508	4964	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dragon_s.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dragon_s.dll,#1
  2⤵
  PID:4508
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 672
    3⤵
    - Program crash
    PID:1548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 352 -p 4508 -ip 4508
1⤵
PID:3304

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads