c4079adbd900f429976e7363d635dca803e7d244675263ebb30b1ea8fc889e29 | Triage

Analysis

max time kernel
134s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
13/05/2024, 23:30

Sharing

Report Analysis Logs

General

Target

KG_LicEnc.dll
Size

372KB
MD5

8a922c5995f02cf1cd6b503711bced13
SHA1

ffd6b9c710bee5abcbf357532f12c28fe5e897e5
SHA256

4d1ecc3574947768c4689ec0a603c6eaf5974aebfbd3b1b415a27f62cc50091c
SHA512

7fc18c2eae42ce4b0d299e661bd661b59d2d293a58a433385b7e18034d4d915f6226c33c3a15a62632df8e08de0d681530f88e808fe5f88c894fc23ab11ce731
SSDEEP

6144:BWazDco8bzUXvnsPCGynyIdOf/RMriEMN+fSdP3o+0RuyuqAl:RsoazUE6xdOHCr9SdPC0yu3

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1456	1672	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 1672	1140	rundll32.exe	82
PID 1140 wrote to memory of 1672	1140	rundll32.exe	82
PID 1140 wrote to memory of 1672	1140	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\KG_LicEnc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\KG_LicEnc.dll,#1
  2⤵
  PID:1672
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 636
    3⤵
    - Program crash
    PID:1456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 1672 -ip 1672
1⤵
PID:408

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1672-0-0x0000000000A10000-0x0000000000A73000-memory.dmp

Filesize
396KB

Download
memory/1672-1-0x0000000000A10000-0x0000000000A73000-memory.dmp

Filesize
396KB

Download