c486b3ea362c122d2ac9507a474f0df7eed2ebcd4db060a6a5f0ee25a51285bb | Triage

Analysis

max time kernel
133s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 15:59

Sharing

Report Analysis Logs

General

Target

lregistry.dll
Size

56KB
MD5

194935c06125e59c1ef6b115c216c52c
SHA1

80b4e778f37e1d43ce4f0820759d8a20d0386504
SHA256

cf74cf55791780249bdfb8324338d7eb192150bc08846ab5a46d9141f2f30e75
SHA512

f2ce8ffb42bef807e1c2b3e0b6a7a97dce598af837264ecb139e1908a79dfd348c50b2644065ee971c318ac4abbef982b133944fc2f3cc9a8cb7ba4e91f1d397
SSDEEP

768:0ML9X9I8hmi9QdHgv8FTcgoAAReeUbaN9AefWgTKTJFKDPIORDz:5L9CmmizOjZ695rTKybR

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2064	1200	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 1200	1096	rundll32.exe	85
PID 1096 wrote to memory of 1200	1096	rundll32.exe	85
PID 1096 wrote to memory of 1200	1096	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\lregistry.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\lregistry.dll,#1
  2⤵
  PID:1200
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1200 -s 616
    3⤵
    - Program crash
    PID:2064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1200 -ip 1200
1⤵
PID:4728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads