4823257b6e91618705a5f1459308365cd3392d2a5e9164e0318a5eee7173d717 | Triage

Analysis

max time kernel
143s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
22-04-2024 01:17

Sharing

Report Analysis Logs

General

Target

NamePipe.dll
Size

126KB
MD5

6c5969b1508f64a1444756e871772315
SHA1

d7e3f62b223d7029c68dc0b0dc1891dd2c29ba25
SHA256

1368dcdde12778913b3920a84ab3b420fb332ef1678cba5767c79b4c5f217572
SHA512

eeac35633185bd334ad607f28db2c1f1ea9c795077d7f723469bdab13b7b9bfd052b9ab8567c8cb12a8e2f3b6d7ef58c96a487ba1fb13d289be2f44773f17f88
SSDEEP

3072:Jc6acIfAGCPsvU5mj1Ef8jUZlVmgwfkBh:JHIfAGIjnf8yagwfO

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4968 4880 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4036 wrote to memory of 4880	4036	rundll32.exe	rundll32.exe
PID 4036 wrote to memory of 4880	4036	rundll32.exe	rundll32.exe
PID 4036 wrote to memory of 4880	4036	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NamePipe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NamePipe.dll,#1
  2⤵
  PID:4880
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4880 -s 612
    3⤵
    - Program crash
    PID:4968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4880 -ip 4880
1⤵
PID:4600

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads