9b587f0574d013ada38f6973195e0ebcb1889952370dd3396e9f89e3622ff81a | Triage

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
22-04-2024 01:43

Sharing

Report Analysis Logs

General

Target

FatOperate.dll
Size

129KB
MD5

66df78ec2a9cd51adcd2771d59086645
SHA1

fc71cfb7701c4f85081f1f016de2749165ad4e6c
SHA256

cf2af9307b8042283e7f69a6126dffed6138957c5e3a237ceaf9cdd63fb94c84
SHA512

dfecd8cb84d6ab6ed25b2f88b7daea53e9a8515568836f9fb8fe28f8468d17fbf81757399b5a362c94de79f706b00c05052b3cb93d8c72c1defafa0ae05b8d5c
SSDEEP

1536:STg8mPw8d4SLbmRPt4Ntxn4tBTjzHS9rck5QyuIoaGsS5yBO:SU82gkbjLprzuIoaGsSoBO

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1900 4944 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3476 wrote to memory of 4944	3476	rundll32.exe	rundll32.exe
PID 3476 wrote to memory of 4944	3476	rundll32.exe	rundll32.exe
PID 3476 wrote to memory of 4944	3476	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\FatOperate.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3476

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\FatOperate.dll,#1
2⤵
PID:4944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4944 -s 604
3⤵
- Program crash
PID:1900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4944 -ip 4944
1⤵
PID:1188

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4944-1-0x0000000000D90000-0x0000000000DA6000-memory.dmp

Filesize
88KB

Download
memory/4944-0-0x0000000000A50000-0x0000000000A79000-memory.dmp

Filesize
164KB

Download