1d14500a00d5f63a796ae8002eaacb21ee3feb348ab52f3d74c85c0f914347c5 | Triage

Analysis

max time kernel
129s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 00:24

Sharing

Report Analysis Logs

General

Target

bin/MSVCRT.dll
Size

260KB
MD5

0b9c183d1565b48fa6e5d1d3d4b86bcc
SHA1

69697324c1e7ad80215fb07ecf6d786e378c568f
SHA256

2d5670881a6d13a100e37da297f6eeb876f68b63073a28eb5d650625c60f9bf7
SHA512

c836a4789270b216f8505074ce34b11d0b509e14b25133f3aab8db55ba5451e150b6633c4392cc83c1007f64da1c824596ff4a77aab5f7d340be4f631b2935f8
SSDEEP

6144:yncoHbacxB5pdVEweKMph18/VhTORAeFMWiFaNF7R5LWCC0uOpL:yncIbac33dVfnM2/Vg/5Bhum

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4704	60	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 400 wrote to memory of 60	400	rundll32.exe	82
PID 400 wrote to memory of 60	400	rundll32.exe	82
PID 400 wrote to memory of 60	400	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\MSVCRT.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:400
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\MSVCRT.dll,#1
  2⤵
  PID:60
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 600
    3⤵
    - Program crash
    PID:4704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 60 -ip 60
1⤵
PID:3232

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads