5f09de90db804401842617dddb5750c6a8d7a27edb409c91f2ef86d0198d3e58 | Triage

Analysis

max time kernel
55s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 05:43

Sharing

Report Analysis Logs

General

Target

postproc.dll
Size

80KB
MD5

72f3b9040826e524473b9da836a3a5e3
SHA1

2f13d40f18736bca4b6416eb39e68d0efcfbcd37
SHA256

b057f6571a95cfd35e16aae5513918ba6235ee24809e70aa63fae714468f583a
SHA512

54876221e1ee1e705142d0e717a04ec4fa911f70a05acbd0468ac85684ec7653253a1c45f577cbe7eb76520c1dbb1677007bf264e91ee5553c43428a4964c30d
SSDEEP

1536:MleonJza7THltm1JjqRXQJFg2oX9W/mxec/dUWbkOboyQGT0:TonJev/mXjqtOm2oX9W/QH/dUWbZboyS

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
916	4532	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 4532	1864	rundll32.exe	84
PID 1864 wrote to memory of 4532	1864	rundll32.exe	84
PID 1864 wrote to memory of 4532	1864	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\postproc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\postproc.dll,#1
  2⤵
  PID:4532
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 600
    3⤵
    - Program crash
    PID:916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4532 -ip 4532
1⤵
PID:2624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads