cb6bb334e15093e624d5a39cac6e119515bc961ea5a1232ab4aa1f6930f21584 | Triage

Analysis

max time kernel
133s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 19:18

Sharing

Report Analysis Logs

General

Target

CalcHashAB.dll
Size

1.2MB
MD5

2fee6586488d8e05ec83cf13c7396c6d
SHA1

ce38a1c2e2a3251f88e9c2eb1757a49d305e10e8
SHA256

87247a454d9a545e7742b05bdfb44c7124f2e7762f3e008c6a7f5646a018dac9
SHA512

e6cca8a6dd3243353b4eb50ea5c1507b7475928f41f05abd22bf2dc963c853fba79ec1fdb51fa282c9b4905b9adea35236e5bbe52d6fa86d8aeae46a097e05ac
SSDEEP

24576:BRo7AfCUuKsOMmSxpeH6FzhjnQf9XPCRh:AAaULKxoH6FzhjnQ4Rh

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3892	4412	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 4412	1372	rundll32.exe	86
PID 1372 wrote to memory of 4412	1372	rundll32.exe	86
PID 1372 wrote to memory of 4412	1372	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CalcHashAB.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\CalcHashAB.dll,#1
  2⤵
  PID:4412
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 600
    3⤵
    - Program crash
    PID:3892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4412 -ip 4412
1⤵
PID:2708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4412-0-0x0000000074C00000-0x0000000074D75000-memory.dmp

Filesize
1.5MB

Download