2a3f928955893e6810408be597a7b15008d5b1999d1b70e3f7a73fcf8cddde58 | Triage

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 19:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

K8UIRender.dll
Size

1.1MB
MD5

45e92b8b1894d2f2c76da7b4c0387ee9
SHA1

ff946d742eb872ef6d4f78fe2e913c329b047f6e
SHA256

c9d41ce239423034ff5bc71cb42fb7c5c411546b02274e2cb41afe84d28bb884
SHA512

af6ce34f8471a04f047f8293b4b6b03f6da9bbec04aa04ca4010c4b7ebdbdea8538e9eb4d550702d89cb3de1f7a244e166ec5815633754502066c3f9f2039401
SSDEEP

24576:wWEREfR7zPpATAEpj9IM+iMQI8S7ph38o:55hUpyl80pCo

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2296	2200	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2200	2184	rundll32.exe	28
PID 2184 wrote to memory of 2200	2184	rundll32.exe	28
PID 2184 wrote to memory of 2200	2184	rundll32.exe	28
PID 2184 wrote to memory of 2200	2184	rundll32.exe	28
PID 2184 wrote to memory of 2200	2184	rundll32.exe	28
PID 2184 wrote to memory of 2200	2184	rundll32.exe	28
PID 2184 wrote to memory of 2200	2184	rundll32.exe	28
PID 2200 wrote to memory of 2296	2200	rundll32.exe	29
PID 2200 wrote to memory of 2296	2200	rundll32.exe	29
PID 2200 wrote to memory of 2296	2200	rundll32.exe	29
PID 2200 wrote to memory of 2296	2200	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\K8UIRender.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\K8UIRender.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 320
    3⤵
    - Program crash
    PID:2296

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2200-1-0x0000000002130000-0x0000000002450000-memory.dmp

Filesize
3.1MB

Download