0849989e8709c10c7fe4c5e5ad3b67263b2686d5c09c40c8ee1e47cdd8c79fca | Triage

Analysis

max time kernel
132s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 23:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

pdfium.dll
Size

13.0MB
MD5

79c950394d3b6fc5ea93fbee2e70de2f
SHA1

16b229f1f6755c814adaa1ab9352fc9e98f996d2
SHA256

8d301086740272454c6a92e3c98426617fa4ed11114989f06913c2127a4a23e2
SHA512

7e1952d022ea6f99a1b9e74c0fa1f7ade73276d4e809ab81827174fe80762b90fc900b64e952fad71a47ff58570a0174a1cf0989c9d319d96a0864cc63bee424
SSDEEP

393216:zrn43oIXzWXQUgjVDj4RH9tXSZsg8dfeqrJ:zrn43oIXzWXoY0ZsTdf5

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4540	4184	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4844 wrote to memory of 4184	4844	rundll32.exe	83
PID 4844 wrote to memory of 4184	4844	rundll32.exe	83
PID 4844 wrote to memory of 4184	4844	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\pdfium.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\pdfium.dll,#1
  2⤵
  PID:4184
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4184 -s 628
    3⤵
    - Program crash
    PID:4540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4184 -ip 4184
1⤵
PID:1480

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads