bf9f383bd10ca183ccf932eb42f55b47403164b21cf17df3efd9508db38d3960 | Triage

Resubmissions

08-05-2024 18:47

240508-xe74fahf4y 7

08-05-2024 18:39

240508-xamlyabh63 7

Analysis

max time kernel
91s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08-05-2024 18:47

Sharing

Report Analysis Logs

General

Target

DuiLib.dll
Size

1.5MB
MD5

c5f786f40704dbcf8cc4fac8fa9be367
SHA1

fe981a98a81cbcee94c28e68997da765214350f4
SHA256

9a9ccc43a64136d1e4c7bde22725f1b24860892f1491443e890963d7b3c6312a
SHA512

22b88281de2ad906b80fa8285d14e5784ce18557759fe0be13cc91c4e88d611c2318013b73807867e7bc6a86d76bc0ba5e774d6bbe8c09182bca9d60fe6d7386
SSDEEP

24576:/fDo3YQNFQzdDiXTZZ5rCthIFjCF5i/qT/+0Kt7r:DoTSaTBrCtKFj4aN0Kt7

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2824	3308	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1424 wrote to memory of 3308	1424	rundll32.exe	81
PID 1424 wrote to memory of 3308	1424	rundll32.exe	81
PID 1424 wrote to memory of 3308	1424	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DuiLib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DuiLib.dll,#1
  2⤵
  PID:3308
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3308 -s 648
    3⤵
    - Program crash
    PID:2824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3308 -ip 3308
1⤵
PID:1908

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads