808ccd81cbb014df3475fa04ffc0fae33470a6d2279052dce33349f208558100 | Triage

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 03:24

Sharing

Report Analysis Logs

General

Target

InstallUtils.dll
Size

110KB
MD5

8d0c8c264ba7338268bed30198088b7e
SHA1

3d7b6b948a25c9593da0346629828c47e9d91422
SHA256

0301e6592d9b69c98eb4c73eb0390881adf3d2f10ff9407b6614e80a4e04361d
SHA512

41cf1e00e419ff42b9d5261e3a16edc6759d7170d515c5116472c5ba12926471d2efa284a307e69ba14549d236ec3b892ab58e302946b29a06600d85f6a19ce1
SSDEEP

1536:EJZYTyUt7jzAXQzd7z3KDsLYIhzfW960c+61c9vasWjcdRzWPXgvi85:YFiN3s5Xc+6uNRz0Qvi85

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1912	2076	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 2076	2992	rundll32.exe	28
PID 2992 wrote to memory of 2076	2992	rundll32.exe	28
PID 2992 wrote to memory of 2076	2992	rundll32.exe	28
PID 2992 wrote to memory of 2076	2992	rundll32.exe	28
PID 2992 wrote to memory of 2076	2992	rundll32.exe	28
PID 2992 wrote to memory of 2076	2992	rundll32.exe	28
PID 2992 wrote to memory of 2076	2992	rundll32.exe	28
PID 2076 wrote to memory of 1912	2076	rundll32.exe	29
PID 2076 wrote to memory of 1912	2076	rundll32.exe	29
PID 2076 wrote to memory of 1912	2076	rundll32.exe	29
PID 2076 wrote to memory of 1912	2076	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\InstallUtils.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\InstallUtils.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2076
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2076 -s 220
    3⤵
    - Program crash
    PID:1912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads