d43d793529aa53d452cc85badf97e5aa04fe09f61d99046c655a51b31709b624 | Triage

Analysis

max time kernel
139s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 03:20

Sharing

Report Analysis Logs

General

Target

WireStack.dll
Size

60KB
MD5

9512728a532428d479e4b6ec590e419e
SHA1

fcb62c541e03e9795f264c62229a6be5757e641f
SHA256

4416944c5a24b112d49ed58644cf4c2df0c8f70731e6feb0dd8b5473edef0588
SHA512

57824c96d500fe011e5c1f848d008d1729e55ce0e11d81f98bba16c8f4941ed66e1823fe8bade3d3809d21921b4e0b667659b1d9b8a455f7f7f35fc456d8a54f
SSDEEP

1536:vtp1+WRFVqiIM3PzwsGoUec5lgbpacgr:vtpYI30uUeilGacy

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3116 1684 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3544 wrote to memory of 1684	3544	rundll32.exe	rundll32.exe
PID 3544 wrote to memory of 1684	3544	rundll32.exe	rundll32.exe
PID 3544 wrote to memory of 1684	3544	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\WireStack.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3544

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\WireStack.dll,#1
2⤵
PID:1684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 608
3⤵
- Program crash
PID:3116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1684 -ip 1684
1⤵
PID:512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads