c4079adbd900f429976e7363d635dca803e7d244675263ebb30b1ea8fc889e29 | Triage

Analysis

max time kernel
140s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 23:30

Sharing

Report Analysis Logs

General

Target

KG_LicEnc.dll
Size

372KB
MD5

8a922c5995f02cf1cd6b503711bced13
SHA1

ffd6b9c710bee5abcbf357532f12c28fe5e897e5
SHA256

4d1ecc3574947768c4689ec0a603c6eaf5974aebfbd3b1b415a27f62cc50091c
SHA512

7fc18c2eae42ce4b0d299e661bd661b59d2d293a58a433385b7e18034d4d915f6226c33c3a15a62632df8e08de0d681530f88e808fe5f88c894fc23ab11ce731
SSDEEP

6144:BWazDco8bzUXvnsPCGynyIdOf/RMriEMN+fSdP3o+0RuyuqAl:RsoazUE6xdOHCr9SdPC0yu3

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2116	2840	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 2840	2884	rundll32.exe	28
PID 2884 wrote to memory of 2840	2884	rundll32.exe	28
PID 2884 wrote to memory of 2840	2884	rundll32.exe	28
PID 2884 wrote to memory of 2840	2884	rundll32.exe	28
PID 2884 wrote to memory of 2840	2884	rundll32.exe	28
PID 2884 wrote to memory of 2840	2884	rundll32.exe	28
PID 2884 wrote to memory of 2840	2884	rundll32.exe	28
PID 2840 wrote to memory of 2116	2840	rundll32.exe	29
PID 2840 wrote to memory of 2116	2840	rundll32.exe	29
PID 2840 wrote to memory of 2116	2840	rundll32.exe	29
PID 2840 wrote to memory of 2116	2840	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\KG_LicEnc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\KG_LicEnc.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2840
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 268
    3⤵
    - Program crash
    PID:2116

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2840-0-0x0000000000210000-0x0000000000273000-memory.dmp

Filesize
396KB

Download
memory/2840-1-0x0000000000210000-0x0000000000273000-memory.dmp

Filesize
396KB

Download