bf9f383bd10ca183ccf932eb42f55b47403164b21cf17df3efd9508db38d3960 | Triage

Resubmissions

08-05-2024 18:47

240508-xe74fahf4y 7

08-05-2024 18:39

240508-xamlyabh63 7

Analysis

max time kernel
91s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08-05-2024 18:47

Sharing

Report Analysis Logs

General

Target

opencv_world320.dll
Size

32.8MB
MD5

07220e8cd7c52c44ed9e7fce22093bce
SHA1

1af9cb70609744cb74b249d70333690694fee4d5
SHA256

7426a67e2c486b8eca586ef7b3ee0b11e28031a81771baa55036d3e683db76c1
SHA512

1ca784c6522766705372c9703dda9e83a4aa3adf8e34dc46023991a3254fbe1d8b4eb7204896b21d34525f3d2811a7aece6a8e3621156bba7c65fb9e0929d75e
SSDEEP

786432:XFdFbmuECTGUleQB0zRFFin0+/wL4ZsC:1dFbmu1GinB0zRFFin0+/wL4Z

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
828	2044	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1060 wrote to memory of 2044	1060	rundll32.exe	81
PID 1060 wrote to memory of 2044	1060	rundll32.exe	81
PID 1060 wrote to memory of 2044	1060	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\opencv_world320.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\opencv_world320.dll,#1
  2⤵
  PID:2044
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 760
    3⤵
    - Program crash
    PID:828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2044 -ip 2044
1⤵
PID:5032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads