610301aed845d5cf63c54e871c568f1b09ed5c4f697b804033f77384ca212d7c | Triage

Analysis

max time kernel
140s
max time network
124s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:34

Sharing

Report Analysis Logs

General

Target

libiconv-2.dll
Size

1.0MB
MD5

a885d3776b14b6ef7e24d0e04df69f86
SHA1

5e45fa5e5bf0c982cc122d104aaba82e6ba2d3a1
SHA256

954b8740a7cbe3728b136d4f36229c599d1f51534137b16e48e3d7ff9c468fdc
SHA512

abfb42f440e361453794579c9898dd0d2574a03284993581e098685a0627b0bfc9e073320334452fce4234b6bc0445619344a735d2bf67272687d6e766eda11b
SSDEEP

24576:Qsd9e2fWVfil8KupGavkg3NyYFbbTTYIBAUZLYSFrQXvW:vd9euug8KupGaXXVYIBAUZLY0QXvW

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2912 wrote to memory of 2924	2912	rundll32.exe	WerFault.exe
PID 2912 wrote to memory of 2924	2912	rundll32.exe	WerFault.exe
PID 2912 wrote to memory of 2924	2912	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libiconv-2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2912

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2912 -s 80
2⤵
PID:2924

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2912-0-0x0000000066000000-0x0000000066102000-memory.dmp

Filesize
1.0MB

Download