0d5d0a7acd5f94c95d0e0d71e5581bdd92fa465baadce7c782319035e5059f77 | Triage

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 02:43

Sharing

Report Analysis Logs

General

Target

RepAnalyser.dll
Size

112KB
MD5

01269943f2f85d99ba406990f1dea880
SHA1

5cdfcb8d996e789af5a845890cd6b6f081d7afb0
SHA256

1ba80ae759d58ef071984ef44e3f075aaa611097572cfae1f95783ef02a4b851
SHA512

68c2002811df0df5b956ad8fe974c77f8ab6ee99da6fa760b02bb55c9a77acf341a20c9a6b6ddaf048f4aa50d958f9f9badc458ecc60429a662787d749cd1756
SSDEEP

1536:ejQZRZ3artJ7bTXzbs7eXLj9GT//lncEGYUtw9wS8B:eUZRta7/X23ZcfYUtw9wS8B

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2616	3420	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3488 wrote to memory of 3420	3488	rundll32.exe	82
PID 3488 wrote to memory of 3420	3488	rundll32.exe	82
PID 3488 wrote to memory of 3420	3488	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\RepAnalyser.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3488
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\RepAnalyser.dll,#1
  2⤵
  PID:3420
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3420 -s 600
    3⤵
    - Program crash
    PID:2616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3420 -ip 3420
1⤵
PID:4060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads