0f8df5a12beb1729f14f6b1dcc2b8a2656e7290eb8fdcb940d38f9aa849aac05 | Triage

Analysis

max time kernel
135s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 12:27

Sharing

Report Analysis Logs

General

Target

AppointmentActivation.dll
Size

116KB
MD5

e580202076ff943eedf20f4d2f3dd450
SHA1

5eceb73d0594be427b02c38e0e0f7bb3555bba36
SHA256

0f8df5a12beb1729f14f6b1dcc2b8a2656e7290eb8fdcb940d38f9aa849aac05
SHA512

12da2f815ed6ad6a4664b04abd5dae8227aea0578036d869fd6c39cac8ec2c0814c3369b67ff64292841876a9e8ad2b856712e3c595ee510fb85b83b9812d100
SSDEEP

3072:KvctryFoh7wBy5n96nUII1fG765zwP5s:nH7/XA

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4636	1820	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3464 wrote to memory of 1820	3464	rundll32.exe	82
PID 3464 wrote to memory of 1820	3464	rundll32.exe	82
PID 3464 wrote to memory of 1820	3464	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AppointmentActivation.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\AppointmentActivation.dll,#1
  2⤵
  PID:1820
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 604
    3⤵
    - Program crash
    PID:4636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1820 -ip 1820
1⤵
PID:1752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads