b622013c43ce8d926d5adad74ba9364c37d31b8343510e36dc5d43962b6e92dd | Triage

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09-06-2024 07:24

Sharing

Report Analysis Logs

General

Target

LiveInstHlp.dll
Size

927KB
MD5

92488cfd96247a4c25b67bae07c2034a
SHA1

87f097278f0c49c9f033451a06e86c4356e5e8e4
SHA256

a9211f2ae6acbe1170a0233d2fd0d2cff09594bff811192ba33aa23839393523
SHA512

4fe7214d1275de3b96b8a8b8203fec2562e2eb3bd975fd6f2e91a84fa309453ae5a81ff69096007122fadc9bf3a04fadf7bf217cb3e5b40110cc3553f75ef83d
SSDEEP

24576:1YOcnipQx46vFxc0rKVkzVLQPHkx1CK5x:1aLRrKOzBQPkrx5x

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process
3600	3544	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 432 wrote to memory of 3544	432	rundll32.exe	84
PID 432 wrote to memory of 3544	432	rundll32.exe	84
PID 432 wrote to memory of 3544	432	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\LiveInstHlp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:432
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\LiveInstHlp.dll,#1
  2⤵
  PID:3544
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 656
    3⤵
    - Program crash
    PID:3600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3544 -ip 3544
1⤵
PID:1724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads