979a66f347df50eea02a69e44985585a1c13d9ed93c63f65ed241dcc142064ae | Triage

Analysis

max time kernel
90s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
08/06/2024, 00:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

$TEMP/R2RLIVE2.dll
Size

90KB
MD5

3ca4451d558602c81380dfc1d22a71c5
SHA1

83222d82d15c0b088422f2d5be707500dcb9fed3
SHA256

a446a90d6873b1fbe20d9ba00ce730012260d8ec8ffd538a98fc61b632b11d96
SHA512

377a93342369d9455df86e49a1b8a40ecfddf5a3db052721baed2530d3d7c21afacf7a9ea58e1b50f56e675d06fd215a8707df529f1bd4312f43714aa44e61ef
SSDEEP

1536:9ZfAwNhtY7blEmlXZ4LaACu/9dpkibbb+S4A3:9ZfAwNhtY7blLXmLaA7dB

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3936	1428	WerFault.exe	78

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 1428	4728	rundll32.exe	78
PID 4728 wrote to memory of 1428	4728	rundll32.exe	78
PID 4728 wrote to memory of 1428	4728	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\R2RLIVE2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\R2RLIVE2.dll,#1
  2⤵
  PID:1428
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1428 -s 468
    3⤵
    - Program crash
    PID:3936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1428 -ip 1428
1⤵
PID:3848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads