ca1abc263018dd7ec1ef25ef7874167445bfa64d50a549b36624d3d679f597e4 | Triage

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
05-05-2024 01:31

Sharing

Report Analysis Logs

General

Target

FRPFILE AIO v2.8.4/ref/win-x64/getopt.dll
Size

19KB
MD5

3c38201a1354890260a5c3af942d1929
SHA1

eaf9a4203b884b5d41d38184f4e45fe415558ed3
SHA256

b3ba9b3f5a55df4faa3df841d7124fc929f6fb28a33d153aeea85fa0416c00bd
SHA512

9cdaf01bc090a30196faa7c38cf8a1b4c4c0ceb2a7750e45de3f762aff3c980b045c4a229dbcf2b745e7816dfeb838e896db900adfccb4ebe5ec98915dee2b34
SSDEEP

384:MmXNDYkWMu59bX1nOvbGaGgU2oRCTGONnc:Rqtv1KqaHowx

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1736 wrote to memory of 760	1736	rundll32.exe	WerFault.exe
PID 1736 wrote to memory of 760	1736	rundll32.exe	WerFault.exe
PID 1736 wrote to memory of 760	1736	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\FRPFILE AIO v2.8.4\ref\win-x64\getopt.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1736

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1736 -s 80
2⤵
PID:760

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...