fcadf0a0a2c90421f3b2b67f4649eabec2d0c8d4dda9127c7621de4ae052f09d | Triage

Analysis

max time kernel
140s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-04-2024 02:06

Sharing

Report Analysis Logs

General

Target

Extxml2.dll
Size

969KB
MD5

fc28759198238c583c62c548b9d7d8f8
SHA1

a8e038088c7f1b689dcc7075316b9aaaeb429a65
SHA256

bc0c134f28fc2573b91f161fb31f819d19970a947f9c1b79acfd2a65d9a6d248
SHA512

6c80315332263f8d59846a16c18cc18a9fbc63b507018a18257e9612c4003dca53a61c7ce978dcf8b42dc1f68b4eec57393b4d01b2c475d315329efcb9957cc9
SSDEEP

24576:lLcKcC0rO2s6c0k0/BMeJywAqiyOJUMEm:FMncDZQizSm

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2852 2836 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2196 wrote to memory of 2836	2196	rundll32.exe	rundll32.exe
PID 2196 wrote to memory of 2836	2196	rundll32.exe	rundll32.exe
PID 2196 wrote to memory of 2836	2196	rundll32.exe	rundll32.exe
PID 2196 wrote to memory of 2836	2196	rundll32.exe	rundll32.exe
PID 2196 wrote to memory of 2836	2196	rundll32.exe	rundll32.exe
PID 2196 wrote to memory of 2836	2196	rundll32.exe	rundll32.exe
PID 2196 wrote to memory of 2836	2196	rundll32.exe	rundll32.exe
PID 2836 wrote to memory of 2852	2836	rundll32.exe	WerFault.exe
PID 2836 wrote to memory of 2852	2836	rundll32.exe	WerFault.exe
PID 2836 wrote to memory of 2852	2836	rundll32.exe	WerFault.exe
PID 2836 wrote to memory of 2852	2836	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Extxml2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2196

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Extxml2.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2836 -s 224
3⤵
- Program crash
PID:2852

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2836-0-0x0000000000240000-0x0000000000319000-memory.dmp

Filesize
868KB

Download
memory/2836-1-0x0000000062E80000-0x0000000062EA2000-memory.dmp

Filesize
136KB

Download