7fa69ce0022452912fc332d5b26137cb5b9040b205e3a6996311ac5ee179160d | Triage

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 06:00

Sharing

Report Analysis Logs

General

Target

cscapi.dll
Size

40KB
MD5

46c4f87c83a0198255184d10b79f9095
SHA1

8e096efc4e249bdfb2ce5398fd7d317245973c2e
SHA256

7fa69ce0022452912fc332d5b26137cb5b9040b205e3a6996311ac5ee179160d
SHA512

7309a5c6452dd3ef263ee726e3bd425c6e3528a5fa1a13f6bd3309e04fd7babbdb6060136c119e7294d9b89a6f08982b233dc8300af3314db584fe975a2b97ae
SSDEEP

768:82zUhEzwc8aujLD1MUOk7qCbWN95BcoNZay2:FBUc8auPhXRuCS35BcoNZ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
856	3968	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 3968	2552	rundll32.exe	82
PID 2552 wrote to memory of 3968	2552	rundll32.exe	82
PID 2552 wrote to memory of 3968	2552	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cscapi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cscapi.dll,#1
  2⤵
  PID:3968
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3968 -s 624
    3⤵
    - Program crash
    PID:856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3968 -ip 3968
1⤵
PID:1508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads