279fcb2ccefca844fcde2a93a4b81e34344b5f7d42a535e62e32df9158b23657 | Triage

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/05/2024, 12:16

Sharing

Report Analysis Logs

General

Target

2345DirectUI.dll
Size

1.4MB
MD5

3b39d4317e74d5b253c81fe9f2f533a8
SHA1

8ad0b30a1755132b78a3fb8271001ba9f2a2d391
SHA256

ea07d6c58e96e843fb8837f6b05a4411a3b6af5cf9138c9744cb534567e05ac3
SHA512

40f78b270e5251b557d3555d01859091de18207a7067b39753fbcdca900546517a6d648e4c7bb835f2ca5effb4515537aef104f22076a9cc87ad1b52c7b0a813
SSDEEP

24576:BONSLtkfu1jY/AHf4xaafWfWwocqz+9FJw:0NSLUu//KcwMFJw

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1500	2312	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 2312	2696	rundll32.exe	28
PID 2696 wrote to memory of 2312	2696	rundll32.exe	28
PID 2696 wrote to memory of 2312	2696	rundll32.exe	28
PID 2696 wrote to memory of 2312	2696	rundll32.exe	28
PID 2696 wrote to memory of 2312	2696	rundll32.exe	28
PID 2696 wrote to memory of 2312	2696	rundll32.exe	28
PID 2696 wrote to memory of 2312	2696	rundll32.exe	28
PID 2312 wrote to memory of 1500	2312	rundll32.exe	29
PID 2312 wrote to memory of 1500	2312	rundll32.exe	29
PID 2312 wrote to memory of 1500	2312	rundll32.exe	29
PID 2312 wrote to memory of 1500	2312	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2345DirectUI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2345DirectUI.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2312
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 232
    3⤵
    - Program crash
    PID:1500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads