21b6a28df6984d1e4822af45b5e4da96672fd52c572709b5ec0c10a254c5ebc5 | Triage

Analysis

max time kernel
132s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 01:51

Sharing

Report Analysis Logs

General

Target

courgette_dll.dll
Size

285KB
MD5

4805c2a01dd250f6870964c4eb4f8b20
SHA1

e905b7236929e770e913a4368b45970b4ad80c6a
SHA256

7e9e356dd8c1a19fa40a04c137dc66d5cabfcc8db38781865d89c4641d24bd6e
SHA512

1670d7a420417d333ab574dcbb9e3a7440d8108225fd4740b9f3ae633c609e89f6e9e9818876804bacfc1a972530c96cd6a61f446217c2d7b8075848a8c54793
SSDEEP

6144:GKMlxyEqM4HioSb9q9t34RNE0t3p/OtJTknT:GfyE0PQ24RNEC3peJc

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2608 2312 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 452 wrote to memory of 2312	452	rundll32.exe	rundll32.exe
PID 452 wrote to memory of 2312	452	rundll32.exe	rundll32.exe
PID 452 wrote to memory of 2312	452	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\courgette_dll.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:452

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\courgette_dll.dll,#1
2⤵
PID:2312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 600
3⤵
- Program crash
PID:2608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2312 -ip 2312
1⤵
PID:3004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads