e0d12494e4129204fbe4f964181b02a5e206e928e0f7b6690ed68ed45e4cdc44 | Triage

Analysis

max time kernel
134s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 05:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

MapGeocoder.dll
Size

1.9MB
MD5

641dadc1aacc568d2d8a9cf228604326
SHA1

7bad8ba057986f86dfe63f6813f7626193bf5519
SHA256

e0d12494e4129204fbe4f964181b02a5e206e928e0f7b6690ed68ed45e4cdc44
SHA512

33105982f1c2dbf2a9fe4502828c2390558e587112d281e291dd39ab9bc832acad904feb80254b564b14c888e32d717bc74af08be84393f4e3ec1d63b3f7b711
SSDEEP

49152:CPVQ2uek4XQjR2Iner6aaz3a12OBgvEKHHmPhxkRRJvFAT:zA6aaDagIgvdHH

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2972	1224	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 1224	3448	rundll32.exe	82
PID 3448 wrote to memory of 1224	3448	rundll32.exe	82
PID 3448 wrote to memory of 1224	3448	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MapGeocoder.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MapGeocoder.dll,#1
  2⤵
  PID:1224
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1224 -s 656
    3⤵
    - Program crash
    PID:2972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1224 -ip 1224
1⤵
PID:3040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads