bf9f383bd10ca183ccf932eb42f55b47403164b21cf17df3efd9508db38d3960 | Triage

Resubmissions

08-05-2024 18:47

240508-xe74fahf4y 7

08-05-2024 18:39

240508-xamlyabh63 7

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
08-05-2024 18:47

Sharing

Report Analysis Logs

General

Target

DuiLib.dll
Size

1.5MB
MD5

c5f786f40704dbcf8cc4fac8fa9be367
SHA1

fe981a98a81cbcee94c28e68997da765214350f4
SHA256

9a9ccc43a64136d1e4c7bde22725f1b24860892f1491443e890963d7b3c6312a
SHA512

22b88281de2ad906b80fa8285d14e5784ce18557759fe0be13cc91c4e88d611c2318013b73807867e7bc6a86d76bc0ba5e774d6bbe8c09182bca9d60fe6d7386
SSDEEP

24576:/fDo3YQNFQzdDiXTZZ5rCthIFjCF5i/qT/+0Kt7r:DoTSaTBrCtKFj4aN0Kt7

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1868	2708	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2708	2972	rundll32.exe	28
PID 2972 wrote to memory of 2708	2972	rundll32.exe	28
PID 2972 wrote to memory of 2708	2972	rundll32.exe	28
PID 2972 wrote to memory of 2708	2972	rundll32.exe	28
PID 2972 wrote to memory of 2708	2972	rundll32.exe	28
PID 2972 wrote to memory of 2708	2972	rundll32.exe	28
PID 2972 wrote to memory of 2708	2972	rundll32.exe	28
PID 2708 wrote to memory of 1868	2708	rundll32.exe	29
PID 2708 wrote to memory of 1868	2708	rundll32.exe	29
PID 2708 wrote to memory of 1868	2708	rundll32.exe	29
PID 2708 wrote to memory of 1868	2708	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DuiLib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DuiLib.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2708 -s 228
    3⤵
    - Program crash
    PID:1868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads