f06b9edda0a7249ee633ff2b469853623e307b981ec43e53ed28bde6704bcee7 | Triage

Analysis

max time kernel
144s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
20/04/2024, 06:27

Sharing

Report Analysis Logs

General

Target

nmap-7.60/libssh2.dll
Size

148KB
MD5

8420802e447c9d49b69ee3a344284609
SHA1

a0b10a12efb955b4214aca595f4cb803099a3eb5
SHA256

63fde79687ffb9e602c2862eaa97747b8d17305b4fee9483ec19f0f7ef671211
SHA512

27213d36a366f3cc93a5d2bdef71b42d7d4d290aff88763dcb0837ba6c1a11ce4abc9df39927e0a57cd39a5f54d962e5171990a91f7c6a4ecb0dd8c3848fd6fd
SSDEEP

3072:wwVNzokQtBJEYEHIwaNJbZwwOyDXb0+er4e1dHqZuRGltH:wwVNzozmYEHI3VbXb07rv1dHqZuYH

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
640	4708	WerFault.exe	91

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 4708	1816	rundll32.exe	91
PID 1816 wrote to memory of 4708	1816	rundll32.exe	91
PID 1816 wrote to memory of 4708	1816	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\nmap-7.60\libssh2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\nmap-7.60\libssh2.dll,#1
  2⤵
  PID:4708
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 628
    3⤵
    - Program crash
    PID:640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4708 -ip 4708
1⤵
PID:1368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4068 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:8
1⤵
PID:3140

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads