808ccd81cbb014df3475fa04ffc0fae33470a6d2279052dce33349f208558100 | Triage

Analysis

max time kernel
134s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 03:24

Sharing

Report Analysis Logs

General

Target

KeyLib.dll
Size

104KB
MD5

3270468a681ce2f3b698daca489346e2
SHA1

72e9e5a6896b8dfae2ee97c175991d62c91dafd4
SHA256

6daa28470c8e539bfac769b5c36f1bc4c656f24d66dbd3e8651c442a3b51543e
SHA512

b8e7534682899941fc593e62b34badf8d95f7a29fa9f018bce9f921c330bd075ad3fca8da59f1898d2b75daba4cd5bf652a79698de32c2215b49c0a20ed9b3c8
SSDEEP

768:ImhRRhGPmdnt/p87ivJe67JbbcjpeWjYrxS5yTmRULH/emoHalXi:ImhRRhAmb/v9lMjpvyg+H/7oHapi

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2672	2776	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3704 wrote to memory of 2776	3704	rundll32.exe	82
PID 3704 wrote to memory of 2776	3704	rundll32.exe	82
PID 3704 wrote to memory of 2776	3704	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\KeyLib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3704
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\KeyLib.dll,#1
  2⤵
  PID:2776
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2776 -s 632
    3⤵
    - Program crash
    PID:2672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2776 -ip 2776
1⤵
PID:3452

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads