97cf70062f25b360a517a632165ac3d0f0a28de8cc332438694be046db8d349c | Triage

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-05-2024 02:29

Sharing

Report Analysis Logs

General

Target

KwDataDef.dll
Size

17KB
MD5

12a3a448167d7547b5678be8ae2ef1d3
SHA1

e560f9f221facd9e94d56d911ceb0cff87de5b14
SHA256

baaa76261d1d79b77f6fda9dd2aace358f36229d5045dc32a6d6ca96e6fb1051
SHA512

4e363dc6ab1ce0e2a98ac9ef7df5fc35ce3c4c077fae9f5bf18739d8229eca3fbad6aab3d927c6c0c323f2847a5fccb2dad31f3cc96556fe896e38ead33e1bd6
SSDEEP

384:LNn8zAHdefJD+02OK/ho6mwJnYPLxukq2eM7:J9eRS02OKu6TJNm

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
108	820	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 820	2092	rundll32.exe	28
PID 2092 wrote to memory of 820	2092	rundll32.exe	28
PID 2092 wrote to memory of 820	2092	rundll32.exe	28
PID 2092 wrote to memory of 820	2092	rundll32.exe	28
PID 2092 wrote to memory of 820	2092	rundll32.exe	28
PID 2092 wrote to memory of 820	2092	rundll32.exe	28
PID 2092 wrote to memory of 820	2092	rundll32.exe	28
PID 820 wrote to memory of 108	820	rundll32.exe	29
PID 820 wrote to memory of 108	820	rundll32.exe	29
PID 820 wrote to memory of 108	820	rundll32.exe	29
PID 820 wrote to memory of 108	820	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\KwDataDef.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\KwDataDef.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:820
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 820 -s 224
    3⤵
    - Program crash
    PID:108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads