979a66f347df50eea02a69e44985585a1c13d9ed93c63f65ed241dcc142064ae | Triage

Analysis

max time kernel
150s
max time network
270s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
05-05-2024 11:10

Sharing

Report Analysis Logs

General

Target

$TEMP/R2RLIVE2.dll
Size

90KB
MD5

3ca4451d558602c81380dfc1d22a71c5
SHA1

83222d82d15c0b088422f2d5be707500dcb9fed3
SHA256

a446a90d6873b1fbe20d9ba00ce730012260d8ec8ffd538a98fc61b632b11d96
SHA512

377a93342369d9455df86e49a1b8a40ecfddf5a3db052721baed2530d3d7c21afacf7a9ea58e1b50f56e675d06fd215a8707df529f1bd4312f43714aa44e61ef
SSDEEP

1536:9ZfAwNhtY7blEmlXZ4LaACu/9dpkibbb+S4A3:9ZfAwNhtY7blLXmLaA7dB

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3316	1828	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 1828	4548	rundll32.exe	82
PID 4548 wrote to memory of 1828	4548	rundll32.exe	82
PID 4548 wrote to memory of 1828	4548	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\R2RLIVE2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\R2RLIVE2.dll,#1
  2⤵
  PID:1828
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1828 -s 612
    3⤵
    - Program crash
    PID:3316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1828 -ip 1828
1⤵
PID:804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads