211c37d00b6555ca57c72c779220f31fdb21394436066991149c604487b44991 | Triage

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
12-05-2024 10:21

Sharing

Report Analysis Logs

General

Target

DuiLib_u.dll
Size

572KB
MD5

caf665bd2b042b8e9e7b8accc8dfa780
SHA1

6d223693e8bd004ab9124183515089e5bf28018e
SHA256

1834e678ae69b5a25b17b3947e8057b7530f8c4fbd897621369ac2d5bad01319
SHA512

3278c666aaca7b51b7691cad4bbbc85a6e1b61f1cecc878f58cdb326e0547d3feb8617d604d7f371ace7248a5e61f0a08c8da0a915ee6b7d7c16ee3cbc01e524
SSDEEP

12288:eRAVI8gONH2qjuunmuapwf+JxSbjIOk+Nn7ReycIszH3z/:4AK8gduapGIxMO/

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1628 1784 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2188 wrote to memory of 1784	2188	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 1784	2188	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 1784	2188	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 1784	2188	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 1784	2188	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 1784	2188	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 1784	2188	rundll32.exe	rundll32.exe
PID 1784 wrote to memory of 1628	1784	rundll32.exe	WerFault.exe
PID 1784 wrote to memory of 1628	1784	rundll32.exe	WerFault.exe
PID 1784 wrote to memory of 1628	1784	rundll32.exe	WerFault.exe
PID 1784 wrote to memory of 1628	1784	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DuiLib_u.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2188

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DuiLib_u.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 228
3⤵
- Program crash
PID:1628

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...