4ef76b942e041c20fd58858d73b4180688c828608d42604eabf41821981ce997 | Triage

Analysis

max time kernel
33s
max time network
34s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16-04-2024 21:11

Sharing

Report Analysis Logs

General

Target

g2m.dll
Size

394KB
MD5

bfdc1d6b753467fb5f1be175beca514e
SHA1

36bb052c5c55a655b670bd728e8915fb8a0f2b1f
SHA256

459557df57eb1e1925fc3130effe1a841867eb5cd450f8cb447fc00e3113d4d2
SHA512

db58afe532944a66c76a10f3cbaf29ab4403e71b78c149ef6063fbc3b023dfbe8c66cdfd3fb3aaacc090b34b38d87c7cbb4d57bf5460709d77161b0f1a1400b7
SSDEEP

6144:c/tGvR6jAvLYCfNdrVD49mkqjLeM4ZWhdR/WQy5tjQuUqcLpH0:cMpvDNA9mkqJzhdR/dUOLpH0

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1272 1032 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 948 wrote to memory of 1032	948	rundll32.exe	rundll32.exe
PID 948 wrote to memory of 1032	948	rundll32.exe	rundll32.exe
PID 948 wrote to memory of 1032	948	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\g2m.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:948

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\g2m.dll,#1
2⤵
PID:1032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1032 -s 612
3⤵
- Program crash
PID:1272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1032 -ip 1032
1⤵
PID:3492

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...