7a3f0b4a49a620084d0bac15f10cf91f8abfcf1276381304903d7dd310e5e289 | Triage

Analysis

max time kernel
131s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 11:42

Sharing

Report Analysis Logs

General

Target

ActivationManager.dll
Size

572KB
MD5

37d2b3a6707982caa1f28d839acbc43a
SHA1

d33ed89b0f84b5bebc32f01f583895ce22e5d203
SHA256

7a3f0b4a49a620084d0bac15f10cf91f8abfcf1276381304903d7dd310e5e289
SHA512

07c980af02171b6338aa8e36b456200ee8fe38ff5713f8c6959ba72253e53017e2ca2cf4b976a4f17da5b79bef18c16da049d6ebe6d99a5711ce53bff84fd6f6
SSDEEP

12288:SBC+Ct7H+X6SKm0mB0Zyv8wOzjLcWkncwKGo3KAvpOKjBkQfqiO:SB3Ct7yx0FyvOzMcwjclpq

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
224	2952	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 2952	1684	rundll32.exe	83
PID 1684 wrote to memory of 2952	1684	rundll32.exe	83
PID 1684 wrote to memory of 2952	1684	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ActivationManager.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ActivationManager.dll,#1
  2⤵
  PID:2952
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2952 -s 716
    3⤵
    - Program crash
    PID:224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2952 -ip 2952
1⤵
PID:1888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads