a77210dc3ae1df36cab033e2b52ca8c656bd5cbc5257a79220526f32f4bf5949 | Triage

Analysis

max time kernel
89s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 22:17

Sharing

Report Analysis Logs

General

Target

DLL3S_UsbAudio16xx_Debug_x32.dll
Size

1.4MB
MD5

edc38aadd31adefb67649ff33d87e255
SHA1

682d27a567fe110c255d514a174f1d7118097690
SHA256

c88e83a8f5bcf4d0966b5dfd494cc3e09993f38893c69ef208f6de8c97575c8d
SHA512

748466475e0ba5b6515ed42937101706662ac70a87be1ae970ca2033205b1e31d9beb6f77954bddb8acf63bfc2cf736911e6bce25ea691acd5b459920282a64d
SSDEEP

24576:Q/WpkZFHRPd8+A4S77oouIfMbw5TciINZhvI7azv:Q/WT+RYPpTciINZhcazv

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
640	2808	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3364 wrote to memory of 2808	3364	rundll32.exe	88
PID 3364 wrote to memory of 2808	3364	rundll32.exe	88
PID 3364 wrote to memory of 2808	3364	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DLL3S_UsbAudio16xx_Debug_x32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DLL3S_UsbAudio16xx_Debug_x32.dll,#1
  2⤵
  PID:2808
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 680
    3⤵
    - Program crash
    PID:640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2808 -ip 2808
1⤵
PID:884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2808-0-0x0000000074F50000-0x0000000075132000-memory.dmp

Filesize
1.9MB

Download
memory/2808-1-0x0000000074F50000-0x0000000075132000-memory.dmp

Filesize
1.9MB

Download