f7ab23061e4f11a4a0f45686b971522d77219b6bf780baa56de0d435738ab93b | Triage

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 00:18

Sharing

Report Analysis Logs

General

Target

WebView2Loader.dll
Size

133KB
MD5

a0bd0d1a66e7c7f1d97aedecdafb933f
SHA1

dd109ac34beb8289030e4ec0a026297b793f64a3
SHA256

79d7e45f8631e8d2541d01bfb5a49a3a090be72b3d465389a2d684680fee2e36
SHA512

2a50ae5c7234a44b29f82ebc2e3cfed37bf69294eb00b2dc8905c61259975b2f3a059c67aeab862f002752454d195f7191d9b82b056f6ef22d6e1b0bb3673d50
SSDEEP

3072:e5i6Uab3sFhPk6vEmG1PU6dLXm2ng3esQDqEt2JljdTu:e5P2e6vERtUyTmHEtmI

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2396 wrote to memory of 3020	2396	rundll32.exe	WerFault.exe
PID 2396 wrote to memory of 3020	2396	rundll32.exe	WerFault.exe
PID 2396 wrote to memory of 3020	2396	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\WebView2Loader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2396 -s 80
  2⤵
  PID:3020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads