ec4a958ab73fa233b4bb5cbaf68ea3486384997d53740bfa9c3307ce150a59dd | Triage

Analysis

max time kernel
145s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
28/04/2024, 10:49

Sharing

Report Analysis Logs

General

Target

unrar32.dll
Size

285KB
MD5

e224eda7b8897e87dd0bccd29161e59e
SHA1

f6af69c41baf5c022b6df0b1585e035e5c308637
SHA256

bfee9f77aa121df848961c8c07ffcca2bb2847f7dca72129bafee8b385a64992
SHA512

f9b5c12a386c4ecba50601190f06670a3bdcb7bfa9f339dfe1ff2309921c881386e0d35caf0a5d69ee734850713e96ee0d07e2f66aec44f501493b348aaaa64e
SSDEEP

6144:+v18GVkTvTOhHdmPGETB4r1z6/hVMy4veuH4RO1+:I1VkXO3Qg1qzX4E

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4472	3108	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 3108	2072	rundll32.exe	81
PID 2072 wrote to memory of 3108	2072	rundll32.exe	81
PID 2072 wrote to memory of 3108	2072	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\unrar32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\unrar32.dll,#1
  2⤵
  PID:3108
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3108 -s 492
    3⤵
    - Program crash
    PID:4472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3108 -ip 3108
1⤵
PID:2584

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads