97cf70062f25b360a517a632165ac3d0f0a28de8cc332438694be046db8d349c | Triage

Analysis

max time kernel
124s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 21:46

Sharing

Report Analysis Logs

General

Target

KwDataDef.dll
Size

17KB
MD5

12a3a448167d7547b5678be8ae2ef1d3
SHA1

e560f9f221facd9e94d56d911ceb0cff87de5b14
SHA256

baaa76261d1d79b77f6fda9dd2aace358f36229d5045dc32a6d6ca96e6fb1051
SHA512

4e363dc6ab1ce0e2a98ac9ef7df5fc35ce3c4c077fae9f5bf18739d8229eca3fbad6aab3d927c6c0c323f2847a5fccb2dad31f3cc96556fe896e38ead33e1bd6
SSDEEP

384:LNn8zAHdefJD+02OK/ho6mwJnYPLxukq2eM7:J9eRS02OKu6TJNm

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2528	208	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 208	2676	rundll32.exe	89
PID 2676 wrote to memory of 208	2676	rundll32.exe	89
PID 2676 wrote to memory of 208	2676	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\KwDataDef.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\KwDataDef.dll,#1
  2⤵
  PID:208
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 608
    3⤵
    - Program crash
    PID:2528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 208 -ip 208
1⤵
PID:752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3792,i,14221647728265121051,6840906015709541562,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:8
1⤵
PID:2696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads