7d93356ce79e5c931bc2951c4284d42fc9210c8e130ffec7833463f3d7aaaa75 | Triage

Analysis

max time kernel
134s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04-05-2024 12:28

Sharing

Report Analysis Logs

General

Target

$INSTDIR"/bin/"/libxml2.dll
Size

625KB
MD5

37d9bf74558c5c4e7cd82e3d94ebb665
SHA1

3d07dbe217f0ded73be5614c6774621a5c9080a7
SHA256

8ed6747212836618800fff123d46759e864cf7369daf175c3e6d7a8a8c4e9b72
SHA512

b0a2e430c7211921a68568ac19d5702acbf8e6aaf0d51dfb767d7f3c3939541d63bf771d6af15cd9e93436b52c5d83bad6ad3d18865f82dd1acbd589121fb271
SSDEEP

12288:Rc2Y6o+rHr+Bd/uEfeffjd5Jc4RdhYRY+G:RnY6o+rHr+/uEfA5h73H

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4748	1136	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 1136	2772	rundll32.exe	85
PID 2772 wrote to memory of 1136	2772	rundll32.exe	85
PID 2772 wrote to memory of 1136	2772	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$INSTDIR_\bin\_\libxml2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$INSTDIR_\bin\_\libxml2.dll,#1
  2⤵
  PID:1136
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1136 -s 616
    3⤵
    - Program crash
    PID:4748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1136 -ip 1136
1⤵
PID:1956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1136-0-0x000000006E5C0000-0x000000006E64A000-memory.dmp

Filesize
552KB

Download