0bb7e3c0492d977fe3b32844b0bccec70a808c2f7a2e36ab0942ed8101d54783 | Triage

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 05:11

Sharing

Report Analysis Logs

General

Target

jpeg.dll
Size

165KB
MD5

e9666bc50ad4c10025c5be293e79f0c2
SHA1

f6fe9dac299714a6360fbe875659faf8d5e1fc57
SHA256

a20dd457485f6455163fca175d72419fd0b820676241e6194edf8c971f5a64b0
SHA512

9c4297dcbc8ffbffe7cbafa3cf9bd5232185942868df40c9dc7d4951a7e26deb5fc8866a281e77314f5cb8369989a08586f10f10b4099db9e3f1d333b9656930
SSDEEP

3072:2sJGuNqNX8pNhsgL5hYA/caYIq/WF1lWbos4DMgR8mfU:FGuNqNX6dZcF/WF1lU14DM7mc

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3492 556 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3264 wrote to memory of 556	3264	rundll32.exe	rundll32.exe
PID 3264 wrote to memory of 556	3264	rundll32.exe	rundll32.exe
PID 3264 wrote to memory of 556	3264	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jpeg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\jpeg.dll,#1
  2⤵
  PID:556
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 556 -s 600
    3⤵
    - Program crash
    PID:3492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 556 -ip 556
1⤵
PID:2024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/556-0-0x0000000064F40000-0x0000000064F67000-memory.dmp

Filesize
156KB

Download