2a3f928955893e6810408be597a7b15008d5b1999d1b70e3f7a73fcf8cddde58 | Triage

Analysis

max time kernel
136s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
16-05-2024 19:39

Sharing

Report Analysis Logs

General

Target

K8UIRender.dll
Size

1.1MB
MD5

45e92b8b1894d2f2c76da7b4c0387ee9
SHA1

ff946d742eb872ef6d4f78fe2e913c329b047f6e
SHA256

c9d41ce239423034ff5bc71cb42fb7c5c411546b02274e2cb41afe84d28bb884
SHA512

af6ce34f8471a04f047f8293b4b6b03f6da9bbec04aa04ca4010c4b7ebdbdea8538e9eb4d550702d89cb3de1f7a244e166ec5815633754502066c3f9f2039401
SSDEEP

24576:wWEREfR7zPpATAEpj9IM+iMQI8S7ph38o:55hUpyl80pCo

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1372	4072	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 4072	4524	rundll32.exe	84
PID 4524 wrote to memory of 4072	4524	rundll32.exe	84
PID 4524 wrote to memory of 4072	4524	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\K8UIRender.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\K8UIRender.dll,#1
  2⤵
  PID:4072
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 688
    3⤵
    - Program crash
    PID:1372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4072 -ip 4072
1⤵
PID:3036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4072-1-0x0000000002DF0000-0x0000000003110000-memory.dmp

Filesize
3.1MB

Download