d1b2b3f02ec42a83a9d3226eef0be7c780fc556429d8344c680ba61ef98ead96 | Triage

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-04-2024 11:05

Sharing

Report Analysis Logs

General

Target

libmmd.dll
Size

4.0MB
MD5

21b4e6fd26af085b9927ed84dc680aa3
SHA1

092c207faa2abd0fa68b461991baa0e535367fe8
SHA256

20336d4d7742e4b156e6c24ecf6ee1ec32127cd6561ec6f73a7204222cea33f9
SHA512

b5ca7732254f7274d78bc534ae1c0f1eef5381c474b2e9e1ab3ee00426a3be6eafcbba5eb9902c7d690dfab6ba10766e8784dd9e2a1b4a1ffefa65301e0cba1b
SSDEEP

98304:UJLi7X0J2iGkPyxtOFk8joEGIbQOpv3VzGOsJQQW:uyqCtOu8UEtb5yOs2D

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2264 wrote to memory of 2124	2264	rundll32.exe	WerFault.exe
PID 2264 wrote to memory of 2124	2264	rundll32.exe	WerFault.exe
PID 2264 wrote to memory of 2124	2264	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libmmd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2264 -s 84
  2⤵
  PID:2124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads