06a7c03d5bdd96a30a32cff0ae0f587fb0e7553b40c43034b90559584adc921f | Triage

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 16:49

Sharing

Report Analysis Logs

General

Target

Main.dll
Size

301KB
MD5

9b66f99ae52d621352f31ee931fa6e3b
SHA1

78bcd566612cd37977c87139d1c72dc0107cd588
SHA256

eeaeded37a27eb8d96ad8a02156247d0467e5eede8318d57c9589403dddc0b17
SHA512

6a8fbb74fd1872a4807c516990c59b16bd1bca607cebf35eacedbf665c7b61d100759c4b255cd2a4495603114e773cbcde7eec75e1be07585d957624cc88b334
SSDEEP

768:Wh2JMH6vwm9SHNdmgRQDHDljFlqyjGk6UILZuWxpgTOZK+5MoXeKUa:Wh2WH6vOdXCPdzriLZ3xmOZJMSe5

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
5012	396	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 920 wrote to memory of 396	920	rundll32.exe	84
PID 920 wrote to memory of 396	920	rundll32.exe	84
PID 920 wrote to memory of 396	920	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Main.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:920
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Main.dll,#1
  2⤵
  PID:396
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 396 -s 632
    3⤵
    - Program crash
    PID:5012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 396 -ip 396
1⤵
PID:2596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads