937a83a1d023ad6cae7c3d9677c7c33cf8f5f7afa3b263c17e1bb6409e06a5d2 | Triage

Analysis

max time kernel
94s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 05:35

Sharing

Report Analysis Logs

General

Target

bitsperf.dll
Size

26KB
MD5

82ca769f90474d5193abd865d12be7ed
SHA1

41928814db8f3b5eaa437816fafff69b5f2ea6cb
SHA256

937a83a1d023ad6cae7c3d9677c7c33cf8f5f7afa3b263c17e1bb6409e06a5d2
SHA512

4948bd414a8c6fa4aabbb9ff93fc3de97fab7801f0728e1209d2a9d2d5f3618f14842caea82e93d68eeb989abd8c7a6f20fc6e78644eff86af1d3180d0e8d49f
SSDEEP

768:VrfH5teup/XrZOA2jlX3YGB9X7/EKm4fTx/LzUmrI:VrSuBrZMjlX30ITxUmrI

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3592	3432	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4792 wrote to memory of 3432	4792	rundll32.exe	82
PID 4792 wrote to memory of 3432	4792	rundll32.exe	82
PID 4792 wrote to memory of 3432	4792	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bitsperf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bitsperf.dll,#1
  2⤵
  PID:3432
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3432 -s 604
    3⤵
    - Program crash
    PID:3592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3432 -ip 3432
1⤵
PID:4484

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads