0bb7e3c0492d977fe3b32844b0bccec70a808c2f7a2e36ab0942ed8101d54783 | Triage

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 05:11

Sharing

Report Analysis Logs

General

Target

jpeg.dll
Size

165KB
MD5

e9666bc50ad4c10025c5be293e79f0c2
SHA1

f6fe9dac299714a6360fbe875659faf8d5e1fc57
SHA256

a20dd457485f6455163fca175d72419fd0b820676241e6194edf8c971f5a64b0
SHA512

9c4297dcbc8ffbffe7cbafa3cf9bd5232185942868df40c9dc7d4951a7e26deb5fc8866a281e77314f5cb8369989a08586f10f10b4099db9e3f1d333b9656930
SSDEEP

3072:2sJGuNqNX8pNhsgL5hYA/caYIq/WF1lWbos4DMgR8mfU:FGuNqNX6dZcF/WF1lU14DM7mc

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2376 1784 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1732 wrote to memory of 1784	1732	rundll32.exe	rundll32.exe
PID 1732 wrote to memory of 1784	1732	rundll32.exe	rundll32.exe
PID 1732 wrote to memory of 1784	1732	rundll32.exe	rundll32.exe
PID 1732 wrote to memory of 1784	1732	rundll32.exe	rundll32.exe
PID 1732 wrote to memory of 1784	1732	rundll32.exe	rundll32.exe
PID 1732 wrote to memory of 1784	1732	rundll32.exe	rundll32.exe
PID 1732 wrote to memory of 1784	1732	rundll32.exe	rundll32.exe
PID 1784 wrote to memory of 2376	1784	rundll32.exe	WerFault.exe
PID 1784 wrote to memory of 2376	1784	rundll32.exe	WerFault.exe
PID 1784 wrote to memory of 2376	1784	rundll32.exe	WerFault.exe
PID 1784 wrote to memory of 2376	1784	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jpeg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\jpeg.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1784
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 224
    3⤵
    - Program crash
    PID:2376

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1784-0-0x0000000064F40000-0x0000000064F67000-memory.dmp

Filesize
156KB

Download