8fc177801ebf737d388b516947106943c8bd3c6b4b3c1ed72486621b617cc397 | Triage

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-05-2024 11:59

Sharing

Report Analysis Logs

General

Target

$TEMP/fireguard.dll
Size

69KB
MD5

0b5dbd2725bc7b0697f9ddeab360920f
SHA1

5b3feef13a8932f40cb6a55e6ca0df39cdc731b3
SHA256

eed5d36879e2d0bee35d885b9546772c00d3f34115c4e23916cccfe87e33ea82
SHA512

773a51541bd7c5f6ee1817b78ad156a8c81c060bc030a0b1f232ddcecabc873ae06b46fd038d44060ad283fd27137ef67854e18fd611157e828b5d8c0b5a6ac9
SSDEEP

768:h2l32rOdVMYGFeJ8md+WOOeNS01MVV8FJSaBRAOa66k4fTEbge:FriRN+WSDUG3pBf6boM

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
868	3000	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 3000	2988	rundll32.exe	28
PID 2988 wrote to memory of 3000	2988	rundll32.exe	28
PID 2988 wrote to memory of 3000	2988	rundll32.exe	28
PID 2988 wrote to memory of 3000	2988	rundll32.exe	28
PID 2988 wrote to memory of 3000	2988	rundll32.exe	28
PID 2988 wrote to memory of 3000	2988	rundll32.exe	28
PID 2988 wrote to memory of 3000	2988	rundll32.exe	28
PID 3000 wrote to memory of 868	3000	rundll32.exe	29
PID 3000 wrote to memory of 868	3000	rundll32.exe	29
PID 3000 wrote to memory of 868	3000	rundll32.exe	29
PID 3000 wrote to memory of 868	3000	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\fireguard.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\fireguard.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 224
    3⤵
    - Program crash
    PID:868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads