d43d793529aa53d452cc85badf97e5aa04fe09f61d99046c655a51b31709b624 | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 03:20

Sharing

Report Analysis Logs

General

Target

WireStack.dll
Size

60KB
MD5

9512728a532428d479e4b6ec590e419e
SHA1

fcb62c541e03e9795f264c62229a6be5757e641f
SHA256

4416944c5a24b112d49ed58644cf4c2df0c8f70731e6feb0dd8b5473edef0588
SHA512

57824c96d500fe011e5c1f848d008d1729e55ce0e11d81f98bba16c8f4941ed66e1823fe8bade3d3809d21921b4e0b667659b1d9b8a455f7f7f35fc456d8a54f
SSDEEP

1536:vtp1+WRFVqiIM3PzwsGoUec5lgbpacgr:vtpYI30uUeilGacy

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2160 2216 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1996 wrote to memory of 2216	1996	rundll32.exe	rundll32.exe
PID 1996 wrote to memory of 2216	1996	rundll32.exe	rundll32.exe
PID 1996 wrote to memory of 2216	1996	rundll32.exe	rundll32.exe
PID 1996 wrote to memory of 2216	1996	rundll32.exe	rundll32.exe
PID 1996 wrote to memory of 2216	1996	rundll32.exe	rundll32.exe
PID 1996 wrote to memory of 2216	1996	rundll32.exe	rundll32.exe
PID 1996 wrote to memory of 2216	1996	rundll32.exe	rundll32.exe
PID 2216 wrote to memory of 2160	2216	rundll32.exe	WerFault.exe
PID 2216 wrote to memory of 2160	2216	rundll32.exe	WerFault.exe
PID 2216 wrote to memory of 2160	2216	rundll32.exe	WerFault.exe
PID 2216 wrote to memory of 2160	2216	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\WireStack.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1996

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\WireStack.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 224
3⤵
- Program crash
PID:2160

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads