4180e68810203f6c7c01fe91b9b6191eb1a5096760e2414a9e1532c662b492ed | Triage

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02-06-2024 10:42

Sharing

Report Analysis Logs

General

Target

rf.dll
Size

2.1MB
MD5

54d952cb44e3c22f7b8d8dd459e76e53
SHA1

acfcdb623611ec1b6b5082029c7f4541267508ae
SHA256

7df5443cc130b0d8c9404d6aebd45de08238ed8939278a4d32b31d9033673758
SHA512

aa589ed555d8c8b0d362a6a8b440a9aed220b968cfcc055b40f8c3d878bf84003f21abbb143cd9815dea400a40d2c18e83aacf36a6acb6f27fe6b5ff768d49cc
SSDEEP

49152:P9psk93RaAB5V27kCGYfd1AEkxXhuTGz3Vc8U6D:P9yGhId1Ah/z3V9U6D

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1836	2164	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2164	2012	rundll32.exe	82
PID 2012 wrote to memory of 2164	2012	rundll32.exe	82
PID 2012 wrote to memory of 2164	2012	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\rf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\rf.dll,#1
  2⤵
  PID:2164
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2164 -s 640
    3⤵
    - Program crash
    PID:1836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2164 -ip 2164
1⤵
PID:1152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads