de0d09c6bb50a8fca9102abbefd7a3a0943a9f9b15da0235bf0f6a753cd6781d | Triage

Analysis

max time kernel
146s
max time network
155s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
25/05/2024, 14:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

SciLexer.dll
Size

937KB
MD5

3f1c8e7ce6b40f9f2a970a9cd7b1b46b
SHA1

51afb6caefdfbed2454ebc072bc4977dce814be9
SHA256

bfe9704b80d6a08946097ffc72b8beb5f35d5e80ee41119186aaeba5d6c479e6
SHA512

7de215d18e624fd343980d0c14a028189e6c4ccd61c700abb1deec854b1b71e1ff635a79a0522c28d7dfacb4dcd63559cf2a801685795b0fe63942cbbabd0595
SSDEEP

24576:tzNuYNEXsnI8TIcid1+NgqAWTcDMmZcN8l+/4lBLONOFxOK:eYNcb8g1T00t3+OBLON2OK

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2088	2408	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2408	2252	rundll32.exe	80
PID 2252 wrote to memory of 2408	2252	rundll32.exe	80
PID 2252 wrote to memory of 2408	2252	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SciLexer.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SciLexer.dll,#1
  2⤵
  PID:2408
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 464
    3⤵
    - Program crash
    PID:2088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2408 -ip 2408
1⤵
PID:4688

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads