808ccd81cbb014df3475fa04ffc0fae33470a6d2279052dce33349f208558100 | Triage

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 03:24

Sharing

Report Analysis Logs

General

Target

InstallUtils.dll
Size

110KB
MD5

8d0c8c264ba7338268bed30198088b7e
SHA1

3d7b6b948a25c9593da0346629828c47e9d91422
SHA256

0301e6592d9b69c98eb4c73eb0390881adf3d2f10ff9407b6614e80a4e04361d
SHA512

41cf1e00e419ff42b9d5261e3a16edc6759d7170d515c5116472c5ba12926471d2efa284a307e69ba14549d236ec3b892ab58e302946b29a06600d85f6a19ce1
SSDEEP

1536:EJZYTyUt7jzAXQzd7z3KDsLYIhzfW960c+61c9vasWjcdRzWPXgvi85:YFiN3s5Xc+6uNRz0Qvi85

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
592	4356	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3120 wrote to memory of 4356	3120	rundll32.exe	83
PID 3120 wrote to memory of 4356	3120	rundll32.exe	83
PID 3120 wrote to memory of 4356	3120	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\InstallUtils.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3120
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\InstallUtils.dll,#1
  2⤵
  PID:4356
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 612
    3⤵
    - Program crash
    PID:592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4356 -ip 4356
1⤵
PID:3400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads