97cf70062f25b360a517a632165ac3d0f0a28de8cc332438694be046db8d349c | Triage

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16-05-2024 02:29

Sharing

Report Analysis Logs

General

Target

KwDataDef.dll
Size

17KB
MD5

12a3a448167d7547b5678be8ae2ef1d3
SHA1

e560f9f221facd9e94d56d911ceb0cff87de5b14
SHA256

baaa76261d1d79b77f6fda9dd2aace358f36229d5045dc32a6d6ca96e6fb1051
SHA512

4e363dc6ab1ce0e2a98ac9ef7df5fc35ce3c4c077fae9f5bf18739d8229eca3fbad6aab3d927c6c0c323f2847a5fccb2dad31f3cc96556fe896e38ead33e1bd6
SSDEEP

384:LNn8zAHdefJD+02OK/ho6mwJnYPLxukq2eM7:J9eRS02OKu6TJNm

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2524	2572	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 448 wrote to memory of 2572	448	rundll32.exe	83
PID 448 wrote to memory of 2572	448	rundll32.exe	83
PID 448 wrote to memory of 2572	448	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\KwDataDef.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:448
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\KwDataDef.dll,#1
  2⤵
  PID:2572
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2572 -s 604
    3⤵
    - Program crash
    PID:2524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2572 -ip 2572
1⤵
PID:3824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads