18689dced7a2bd32ff0b18ac5adad3d0fbdb0c5f58179f902ab864d4dbfce438 | Triage

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 12:06

Sharing

Report Analysis Logs

General

Target

yktdef.dll
Size

351KB
MD5

9e9986c789dbf9b6e8c562551f13931a
SHA1

4cb5cb33251ac3d450140df4901099a0b70ddaf5
SHA256

18689dced7a2bd32ff0b18ac5adad3d0fbdb0c5f58179f902ab864d4dbfce438
SHA512

40e1f638da12545aa11f2ff718f7db89482856ac97fd9fe61d7aa6b6a85b0d325260ac93cc5c52f86dff084bdff24256305b6c11584bbedd749539bf6551952f
SSDEEP

6144:esd+H21rsPYWb4IA3BCunm/8IMNMLKS1HAtn:vAH21HpIA5n+MNMLx1HS

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2808	2016	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2016	2320	rundll32.exe	28
PID 2320 wrote to memory of 2016	2320	rundll32.exe	28
PID 2320 wrote to memory of 2016	2320	rundll32.exe	28
PID 2320 wrote to memory of 2016	2320	rundll32.exe	28
PID 2320 wrote to memory of 2016	2320	rundll32.exe	28
PID 2320 wrote to memory of 2016	2320	rundll32.exe	28
PID 2320 wrote to memory of 2016	2320	rundll32.exe	28
PID 2016 wrote to memory of 2808	2016	rundll32.exe	29
PID 2016 wrote to memory of 2808	2016	rundll32.exe	29
PID 2016 wrote to memory of 2808	2016	rundll32.exe	29
PID 2016 wrote to memory of 2808	2016	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\yktdef.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\yktdef.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2016
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 256
    3⤵
    - Program crash
    PID:2808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads