e9e96bfcecf2f4fdc536cb0e8b1b2a08cb660f4b73a87099deeb7cbf0cb62210 | Triage

Analysis

max time kernel
134s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04-06-2024 08:36

Sharing

Report Analysis Logs

General

Target

proc.dll
Size

462KB
MD5

6aac836bde08d9c6fee6c91cc1ac631f
SHA1

b10817a68208bbeb22172afcd40227a35cee4cda
SHA256

f9d9b9d36c6077f75f86343fcd4cddb1dc4965d42c77e19f60e2515f97e7571b
SHA512

d9901d553bdf0acb92ed0b92bd14ec4f9d11e7ffeb534ae4fe664e14bfe917d2434f09e945c07bdc0b4da0dc13cb65829c7f066ee6d87452ba5bbbcdf900a1b4
SSDEEP

6144:HEKrFfU19u5mbwAKKzqMmrDmM6GBCpBns2OJBCQf3rt63AQ49VYDQxc/D:HEKlGu5mk/KzqMmr91p2ECQfw3CVYHD

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4828 1168 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3636 wrote to memory of 1168	3636	rundll32.exe	rundll32.exe
PID 3636 wrote to memory of 1168	3636	rundll32.exe	rundll32.exe
PID 3636 wrote to memory of 1168	3636	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\proc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3636

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\proc.dll,#1
2⤵
PID:1168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 628
3⤵
- Program crash
PID:4828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1168 -ip 1168
1⤵
PID:2792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...