2c848761a6f0a696ea850d8937382e5782c097927ab86419eaff41f1a4b87dbd | Triage

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
31-05-2024 13:42

Sharing

Report Analysis Logs

General

Target

$TEMP/R2RSWKG2.dll
Size

33KB
MD5

0755d77fed72b371793c9a09caf4d1cd
SHA1

12a784611f3cedab5185f8234cab78248f407554
SHA256

15068bc7feb6331d79efae0904f190b8721e8f7e97235a91e2fdc851885dfc04
SHA512

7481eb1f9624b69a7e319ac698eb1d8636f4e58142b894652ee2f00548f5523c9ae8da2fb48b41f69f64e49305b36bd23e88dacc5396ff3fcc521f9604056fa6
SSDEEP

768:D9SnWTXDmQPi1b5Uhoibbb+S4AJKqBz8MZ4wf8K:D9SWHhi1vibbb+S4A36wf8K

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4624	1256	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 1256	3004	rundll32.exe	82
PID 3004 wrote to memory of 1256	3004	rundll32.exe	82
PID 3004 wrote to memory of 1256	3004	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\R2RSWKG2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\R2RSWKG2.dll,#1
  2⤵
  PID:1256
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 600
    3⤵
    - Program crash
    PID:4624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1256 -ip 1256
1⤵
PID:4044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads