0a6180189e4f5911e0bdf60d52fa85a31cf1f6a55625b3bb17d066e07a1a4705 | Triage

Analysis

max time kernel
138s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 00:20

Sharing

Report Analysis Logs

General

Target

CrashRpt.dll
Size

59KB
MD5

f71ba7c61956c3a00cee850b98891608
SHA1

3a2ad1ec74f39b19ea7e61cff7cdc6890cba38fc
SHA256

f22c1509d7b2102a2d174d86703f711357a16b6092841d077edd3c58788248ba
SHA512

f753a42b0662ee7cfb67ff00024d2971102a02d35570e8060360182a83ffa30bda36565038e554740596484a0fdab98ad2816cf8576be3cea33520e973adff8e
SSDEEP

1536:XxmiZQE5OI/oulCHbujj+YQfi0OinqinZAOfUL8u:XQ25HouMbuGYQfi0OiqinaOfUL8u

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4532 wrote to memory of 2972	4532	rundll32.exe	rundll32.exe
PID 4532 wrote to memory of 2972	4532	rundll32.exe	rundll32.exe
PID 4532 wrote to memory of 2972	4532	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CrashRpt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4532

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CrashRpt.dll,#1
2⤵
PID:2972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4244,i,13035806169561352434,1332896185314862791,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:8
1⤵
PID:4204

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...