97e9a785a03853a9cc0d49424a0fb30520fcdd45673f416fbbb87cc81f19d2db | Triage

Analysis

max time kernel
148s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 05:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

dhcpcsvc6.dll
Size

60KB
MD5

93d0261a9ae9ecc94ca493ec377597a2
SHA1

509cab32b33f6efdeb70473fcc8832cc1d62bfb9
SHA256

97e9a785a03853a9cc0d49424a0fb30520fcdd45673f416fbbb87cc81f19d2db
SHA512

9f5ac896cdb3e9104c1add65dfec2128ab24aa079c8d0b91fe044fd9a5a8b7e0cf406edb18d4fa631986ddc90661cded56d49cd29c74aa33e1297f04d2ca7ddc
SSDEEP

768:/RhKljMrtbgrDsR5BPAlwgYbEn1lmph02hn7F00rYQ4:inQAl7WphFhn7aWp4

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4448	1536	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 464 wrote to memory of 1536	464	rundll32.exe	83
PID 464 wrote to memory of 1536	464	rundll32.exe	83
PID 464 wrote to memory of 1536	464	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dhcpcsvc6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:464
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dhcpcsvc6.dll,#1
  2⤵
  PID:1536
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 604
    3⤵
    - Program crash
    PID:4448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1536 -ip 1536
1⤵
PID:3640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads