27bf8e239f59a87c27cc9d1c7e92adece25427d246cb5c04fa0237930181fea9 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 04:47

Sharing

Report Analysis Logs

General

Target

$R2/CrashRpt1403.dll
Size

261KB
MD5

a4056f126c880f3a063e7b7918e78d92
SHA1

c8656f7fbc85d17a6ee63961933192ddb6f6624a
SHA256

d5f8d05db8459a147729e18745ce24d2511d77204dcea064423de387cced6c96
SHA512

5ed909d3cfd90761e4c6915e85ca4c9612b430548b965cdf93e288a10795427f85dfe2fb1a7e4123d5b88dda99ec76a24e15fcbeb24aa126299e24a87fa7b214
SSDEEP

6144:SvoV8jCL6O30U2RkVnL4GLQKpTc21J3y:XV8jVa0U2R2Lfp5c21Fy

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 2012	1132	rundll32.exe	28
PID 1132 wrote to memory of 2012	1132	rundll32.exe	28
PID 1132 wrote to memory of 2012	1132	rundll32.exe	28
PID 1132 wrote to memory of 2012	1132	rundll32.exe	28
PID 1132 wrote to memory of 2012	1132	rundll32.exe	28
PID 1132 wrote to memory of 2012	1132	rundll32.exe	28
PID 1132 wrote to memory of 2012	1132	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$R2\CrashRpt1403.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$R2\CrashRpt1403.dll,#1
  2⤵
  PID:2012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads