4d4d53b1838441f48f171c68ff21096c582492866a8fd2fa7f8e91e24cf8a0d7 | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 03:18

Sharing

Report Analysis Logs

General

Target

winhttp.dll
Size

24KB
MD5

f67ed749e83419d4086d6ad9b8428b35
SHA1

805ea44fbc71842b321e56f7ab99914142d29d89
SHA256

cf9dd372ca0ddbe01153502c49f8f756197bb260001792fe766f6c0242dc7fc0
SHA512

c638647478e0093e7b845857c0288f8b33a1b7b15ed18f51259bfd37897c4b29a1d386203bfde6f0d9da09ba33259b8e58e06eff2c44e5c22d0e6a454536556a
SSDEEP

768:TmX/SGuGzPdSoQLB0GgsC1fxgKT5ImckVPxIiT7V:YY90GgsC1fxgKT5ImckVPxIiT

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2956 wrote to memory of 2036	2956	rundll32.exe	WerFault.exe
PID 2956 wrote to memory of 2036	2956	rundll32.exe	WerFault.exe
PID 2956 wrote to memory of 2036	2956	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\winhttp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2956

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2956 -s 108
2⤵
PID:2036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads