64e167683e619a5c5bb9e13852cd1908ddebc7505f4074f53327b48d14538f1f | Triage

Analysis

max time kernel
66s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
29-04-2024 12:53

Sharing

Report Analysis Logs

General

Target

IP.dll
Size

89KB
MD5

38ed71d99dd2bb013c4bc8e065d87e3e
SHA1

e11be1e6647911705a90ec0f55787d2dba3e6ca0
SHA256

286069d12c8f12a00aef558d02426dfdbe3a6337b05dea53b70a3d3cfcf49ff9
SHA512

0480789002f9dd3bc52e49eb534471ab1db81be9fd94522373d14a81735aea7e20a995748edc131b0ec6ba49b420c56a030e955cffdb45ba410392dc7a8c0983
SSDEEP

1536:N+/uD66eFQO8mxmi3dFDhoKAWZbpHDd6wW/YPHb5rgakGRbiTfWS4t2Ag35DkLg8:N+ao3n2I6wW/YPb1DOTfWS0VgpJ8

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

912 2560 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1388 wrote to memory of 2560	1388	rundll32.exe	rundll32.exe
PID 1388 wrote to memory of 2560	1388	rundll32.exe	rundll32.exe
PID 1388 wrote to memory of 2560	1388	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\IP.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1388

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\IP.dll,#1
2⤵
PID:2560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 568
3⤵
- Program crash
PID:912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2560 -ip 2560
1⤵
PID:4032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...