f4665a7274e113691256ab2e8d894098a5861558492ad71ee76544d029a172c1 | Triage

Analysis

max time kernel
130s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 22:54

Sharing

Report Analysis Logs

General

Target

aacdec.dll
Size

88KB
MD5

47b44dfb02c26615e7ba763b61f7a831
SHA1

0295bc07aad6e3bb568a976ca03faa1f5644bf7e
SHA256

3d513795508b9b9ef2ef9d768bcb12f3cd78be811221dd70332dc249b660b4d1
SHA512

c548a90f4214aa6d8640e7c01b820edda71d5aa5f08fc9581f68fdfdeaaab25bded6ea22da1ebcd8e1b8dafea4e8557758db032a57dbae8be69e2fc3b4caab94
SSDEEP

1536:6sTOMcxf7jORaXLfK/lpbn/qVDbPSKTwKfCSGitiBYMEjhwrZDRZ9A:pTOMcxTCRaby///IPSfutt0YMEUDRzA

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4688 3660 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2204 wrote to memory of 3660	2204	rundll32.exe	rundll32.exe
PID 2204 wrote to memory of 3660	2204	rundll32.exe	rundll32.exe
PID 2204 wrote to memory of 3660	2204	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aacdec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2204

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aacdec.dll,#1
2⤵
PID:3660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3660 -s 600
3⤵
- Program crash
PID:4688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3660 -ip 3660
1⤵
PID:4668

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...