4823257b6e91618705a5f1459308365cd3392d2a5e9164e0318a5eee7173d717 | Triage

Analysis

max time kernel
137s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
22-04-2024 01:17

Sharing

Report Analysis Logs

General

Target

CalcHashAB.dll
Size

1.2MB
MD5

4a94dc352cb914d12ac656ab6c3dcdc9
SHA1

4118f895b5b4c35ccae013a7d019533b1d1633eb
SHA256

a9fe821e9e56a8c7bca32b629ba936e38793a56efb118081db26565c9972344b
SHA512

06b86958acc821b42d45655b86d7a3e022be3f88f013e9aa10a9c667dd27563c871724a3df3e6cda1703e68589def53b783ddcfd4d3b24350dfe6dc0ddf26a5b
SSDEEP

24576:RRo7AfCUuKsOMmSxpeH6FzhjnQf9XPCRn:wAaULKxoH6FzhjnQ4Rn

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3152 1988 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4064 wrote to memory of 1988	4064	rundll32.exe	rundll32.exe
PID 4064 wrote to memory of 1988	4064	rundll32.exe	rundll32.exe
PID 4064 wrote to memory of 1988	4064	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CalcHashAB.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4064

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CalcHashAB.dll,#1
2⤵
PID:1988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 600
3⤵
- Program crash
PID:3152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1988 -ip 1988
1⤵
PID:1616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1988-0-0x0000000074E80000-0x0000000074FF5000-memory.dmp

Filesize
1.5MB

Download
memory/1988-1-0x0000000074E80000-0x0000000074FF5000-memory.dmp

Filesize
1.5MB

Download