1dff748cbad8d2b8ec94f26a90f36ff1ace5cc273c95e2aa50aa704361672f84 | Triage

Analysis

max time kernel
136s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-05-2024 21:53

Sharing

Report Analysis Logs

General

Target

EDEC.dll
Size

113KB
MD5

26b1f5d031c67a0b4a1832d1b4e6422c
SHA1

55e3f43d5658f2d11e07009b16c741f9c878e692
SHA256

8e2161bb8e06751e523f52b763f55d4c74e62a260b0820613111d1351717abc0
SHA512

f5014a47c5990701839d20f893d74eabdfa60d50d2a879d197541fe0141434a25bead206b6eef3237ba71d862201ca0767df9deecb8c66a52e5a952742f127e0
SSDEEP

3072:/ee/ef/hUwswzItFXRohA3AJ2k2FQI/J:/R/g/RuFaWVb

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1580 4780 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4384 wrote to memory of 4780	4384	rundll32.exe	rundll32.exe
PID 4384 wrote to memory of 4780	4384	rundll32.exe	rundll32.exe
PID 4384 wrote to memory of 4780	4384	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\EDEC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\EDEC.dll,#1
  2⤵
  PID:4780
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 600
    3⤵
    - Program crash
    PID:1580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4780 -ip 4780
1⤵
PID:4128

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads