8fc177801ebf737d388b516947106943c8bd3c6b4b3c1ed72486621b617cc397 | Triage

Analysis

max time kernel
134s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
05-05-2024 11:59

Sharing

Report Analysis Logs

General

Target

$TEMP/fireguard.dll
Size

69KB
MD5

0b5dbd2725bc7b0697f9ddeab360920f
SHA1

5b3feef13a8932f40cb6a55e6ca0df39cdc731b3
SHA256

eed5d36879e2d0bee35d885b9546772c00d3f34115c4e23916cccfe87e33ea82
SHA512

773a51541bd7c5f6ee1817b78ad156a8c81c060bc030a0b1f232ddcecabc873ae06b46fd038d44060ad283fd27137ef67854e18fd611157e828b5d8c0b5a6ac9
SSDEEP

768:h2l32rOdVMYGFeJ8md+WOOeNS01MVV8FJSaBRAOa66k4fTEbge:FriRN+WSDUG3pBf6boM

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1980	2272	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3288 wrote to memory of 2272	3288	rundll32.exe	83
PID 3288 wrote to memory of 2272	3288	rundll32.exe	83
PID 3288 wrote to memory of 2272	3288	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\fireguard.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\fireguard.dll,#1
  2⤵
  PID:2272
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 600
    3⤵
    - Program crash
    PID:1980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2272 -ip 2272
1⤵
PID:4984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads