4823257b6e91618705a5f1459308365cd3392d2a5e9164e0318a5eee7173d717 | Triage

Analysis

max time kernel
121s
max time network
131s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-04-2024 01:17

Sharing

Report Analysis Logs

General

Target

NamePipe.dll
Size

126KB
MD5

6c5969b1508f64a1444756e871772315
SHA1

d7e3f62b223d7029c68dc0b0dc1891dd2c29ba25
SHA256

1368dcdde12778913b3920a84ab3b420fb332ef1678cba5767c79b4c5f217572
SHA512

eeac35633185bd334ad607f28db2c1f1ea9c795077d7f723469bdab13b7b9bfd052b9ab8567c8cb12a8e2f3b6d7ef58c96a487ba1fb13d289be2f44773f17f88
SSDEEP

3072:Jc6acIfAGCPsvU5mj1Ef8jUZlVmgwfkBh:JHIfAGIjnf8yagwfO

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2308 1508 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2264 wrote to memory of 1508	2264	rundll32.exe	rundll32.exe
PID 2264 wrote to memory of 1508	2264	rundll32.exe	rundll32.exe
PID 2264 wrote to memory of 1508	2264	rundll32.exe	rundll32.exe
PID 2264 wrote to memory of 1508	2264	rundll32.exe	rundll32.exe
PID 2264 wrote to memory of 1508	2264	rundll32.exe	rundll32.exe
PID 2264 wrote to memory of 1508	2264	rundll32.exe	rundll32.exe
PID 2264 wrote to memory of 1508	2264	rundll32.exe	rundll32.exe
PID 1508 wrote to memory of 2308	1508	rundll32.exe	WerFault.exe
PID 1508 wrote to memory of 2308	1508	rundll32.exe	WerFault.exe
PID 1508 wrote to memory of 2308	1508	rundll32.exe	WerFault.exe
PID 1508 wrote to memory of 2308	1508	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NamePipe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2264

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NamePipe.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 224
3⤵
- Program crash
PID:2308

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...