e723ee615d7a64e918ab185b645324a0cb1b376302d33b54995b54da39be51f3 | Triage

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-05-2024 20:31

Sharing

Report Analysis Logs

General

Target

SASHOOK.dll
Size

65KB
MD5

c278352103ee28bfbabd18254d15a430
SHA1

9db1e8176f02b9c83ba4a7ec69efad35b4d0e37b
SHA256

79b40a60711f5687d20afe695074a535397ed87ca42df2e47ea545f2c0ebc3bf
SHA512

df59ff1b1023edd4d4a40a83a80a5706de74c28f4b04b47a122f1d1335b57e81d0cabe4160246a5b3f5aa38788e248bd9c045c85e0c4477c5078cc3ff3142e4e
SSDEEP

1536:C465M/t+I4qiROQF2huU4VN1y891bXhOrs5SQAGkGzWoc:C4LwvROQF2Y/g8pOriSQ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1748 2104 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 808 wrote to memory of 2104	808	rundll32.exe	rundll32.exe
PID 808 wrote to memory of 2104	808	rundll32.exe	rundll32.exe
PID 808 wrote to memory of 2104	808	rundll32.exe	rundll32.exe
PID 808 wrote to memory of 2104	808	rundll32.exe	rundll32.exe
PID 808 wrote to memory of 2104	808	rundll32.exe	rundll32.exe
PID 808 wrote to memory of 2104	808	rundll32.exe	rundll32.exe
PID 808 wrote to memory of 2104	808	rundll32.exe	rundll32.exe
PID 2104 wrote to memory of 1748	2104	rundll32.exe	WerFault.exe
PID 2104 wrote to memory of 1748	2104	rundll32.exe	WerFault.exe
PID 2104 wrote to memory of 1748	2104	rundll32.exe	WerFault.exe
PID 2104 wrote to memory of 1748	2104	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SASHOOK.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:808
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SASHOOK.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2104
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 232
    3⤵
    - Program crash
    PID:1748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2104-0-0x0000000000170000-0x0000000000188000-memory.dmp

Filesize
96KB

Download
memory/2104-1-0x0000000000170000-0x0000000000188000-memory.dmp

Filesize
96KB

Download