767091a7c1294e9909cf14424ba538fb3a40569d4a1cbb86ffeed199e9745328 | Triage

Analysis

max time kernel
66s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27-04-2024 19:30

Sharing

Report Analysis Logs

General

Target

ref/win-x86/irecovery.dll
Size

39KB
MD5

94a50deeee318e653d74a62e03c56ea8
SHA1

c33a9871dc0734b9a308aa927cafff88b0c29d38
SHA256

c8287b85e15a4e1df220bba4d584d644963d93471be6e92e5cdd19e53bfdbdc9
SHA512

526789c01dbee989eb6a8a1c251de7087c799d1f799104c23b6422985eba1e16331ae04f926c70d485eb93805c4c01aed64d03b67e70bdf177bc9862c2e72790
SSDEEP

768:xZVdRtyNdddlSMg7tmEom5P9wofPoY7YFLrk3NWqVQ5L:xZyNdddlSMg7tmEtP2ofIryQ7

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3184 1984 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2916 wrote to memory of 1984	2916	rundll32.exe	rundll32.exe
PID 2916 wrote to memory of 1984	2916	rundll32.exe	rundll32.exe
PID 2916 wrote to memory of 1984	2916	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ref\win-x86\irecovery.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ref\win-x86\irecovery.dll,#1
  2⤵
  PID:1984
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 604
    3⤵
    - Program crash
    PID:3184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 1984 -ip 1984
1⤵
PID:4428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads