767091a7c1294e9909cf14424ba538fb3a40569d4a1cbb86ffeed199e9745328 | Triage

Analysis

max time kernel
66s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27-04-2024 19:30

Sharing

Report Analysis Logs

General

Target

ref/win-x86/libiconv.dll
Size

896KB
MD5

6e4b07861dfcfeb887a9a289fd67fb5d
SHA1

2ac405d7f904bfdc6e596a11b9c7580231a23623
SHA256

85b2b9439c03d710d4cbe14c89dd8b29466113074235c93228d4dc1568526112
SHA512

20d8106e1d273ecf96df944e25655b54a72cdeea2f1bfb1e3a6f9bb1982f2582be0fa4046d52fd4485fc63477de2221870102f3a14b4b9371b1de13909385e92
SSDEEP

24576:VrWVUVGfVQf0llKuuGavkg3NyZqbbTvzhBAUZLYZ:VQuKlKuuGaXKKzhBAUZLYZ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

740 4848 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3928 wrote to memory of 4848	3928	rundll32.exe	rundll32.exe
PID 3928 wrote to memory of 4848	3928	rundll32.exe	rundll32.exe
PID 3928 wrote to memory of 4848	3928	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ref\win-x86\libiconv.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3928
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ref\win-x86\libiconv.dll,#1
  2⤵
  PID:4848
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 604
    3⤵
    - Program crash
    PID:740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4848 -ip 4848
1⤵
PID:3228

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads