4823257b6e91618705a5f1459308365cd3392d2a5e9164e0318a5eee7173d717 | Triage

Analysis

max time kernel
142s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
22-04-2024 01:17

Sharing

Report Analysis Logs

General

Target

FatOperate.dll
Size

129KB
MD5

c7dc8bee542b93069bce54626d351b61
SHA1

e9eadc23f849b0d1d05da61bd98cf4b7a9117ebd
SHA256

63eabf367d010fc615104870b88c1d2b9e9d9664f70d22584c7aa807292dcc40
SHA512

7d95796018008a46385917f24cc60a9f1338cc977c6552b14025879caca74f5963dc5ce12fa703db7f69e1b5cdfa818c1b4c5318a70934b658456e7bc7c8bd1a
SSDEEP

1536:tTg8mPw8d4SLbmRPt4Ntxn4tBTjzHS9rck5QyuIoaGsS5yBL:tU82gkbjLprzuIoaGsSoBL

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1916 1620 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4236 wrote to memory of 1620	4236	rundll32.exe	rundll32.exe
PID 4236 wrote to memory of 1620	4236	rundll32.exe	rundll32.exe
PID 4236 wrote to memory of 1620	4236	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\FatOperate.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\FatOperate.dll,#1
  2⤵
  PID:1620
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 604
    3⤵
    - Program crash
    PID:1916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1620 -ip 1620
1⤵
PID:4896

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1620-0-0x0000000002AC0000-0x0000000002AD6000-memory.dmp

Filesize
88KB

Download
memory/1620-1-0x0000000002AE0000-0x0000000002B09000-memory.dmp

Filesize
164KB

Download