96e0f2a803195e87752de63e91566dfe74b565d80e3c36efd90d85ec1b3be632 | Triage

Analysis

max time kernel
134s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 20:33

Sharing

Report Analysis Logs

General

Target

$TEMP/glossitis.dll
Size

72KB
MD5

38e1a078aaf0a8feea3d3a6317b6e85e
SHA1

5b35cbdd235366eac93d409e7b5cfe43db444f64
SHA256

c193d53bc725e9ddcea48506f4f48bea90e665fa145a12ac1a6d1ddd0f6e113b
SHA512

2b7987f4598d9831e3f53182117e0ca49ead034358211b8fe5ae13377d9950591bf87468c12e315caf575db82cc5d0c46f0d67059d340d4fe2543dba0bc98c35
SSDEEP

768:v3nHgLuguUvuwnoARRwgVGKwbP8/bt3k86K0V/s+qzJd+8JYK:fALnca1RRwg8KQq76S+iv+j

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
924	3728	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 3728	2012	rundll32.exe	82
PID 2012 wrote to memory of 3728	2012	rundll32.exe	82
PID 2012 wrote to memory of 3728	2012	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\glossitis.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\glossitis.dll,#1
  2⤵
  PID:3728
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3728 -s 556
    3⤵
    - Program crash
    PID:924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3728 -ip 3728
1⤵
PID:3348

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads