ffc673f964fb067cdbb7998e307f8811e6cc161392dccf6273d03cadfb4e7917 | Triage

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11-06-2024 17:44

Sharing

Report Analysis Logs

General

Target

core.dll
Size

56KB
MD5

9888f4f608d1fbd5cb440fd12ac846c6
SHA1

6e9d68202df8a8a1ef23d7b626e28a92d4cba11b
SHA256

678df0973f3132e65345aa4443c27ad9d59c10997cfe96489725d4659532974a
SHA512

6189e53d19ae7266cc76782a5dd235547a9e4b9cf469d0d21056882e00cb824df5744f92c9ade98ff3e7f24de7b56675f90b9a85043511dcd6ec04a16ba8cf51
SSDEEP

768:VprFS20OyoOjhEROHiyJVbDMVkqEA5hSo0nC/eFD:VpI20O/OuOCyJV8GqEA5enC/ID

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2204	2480	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2480	2416	rundll32.exe	28
PID 2416 wrote to memory of 2480	2416	rundll32.exe	28
PID 2416 wrote to memory of 2480	2416	rundll32.exe	28
PID 2416 wrote to memory of 2480	2416	rundll32.exe	28
PID 2416 wrote to memory of 2480	2416	rundll32.exe	28
PID 2416 wrote to memory of 2480	2416	rundll32.exe	28
PID 2416 wrote to memory of 2480	2416	rundll32.exe	28
PID 2480 wrote to memory of 2204	2480	rundll32.exe	29
PID 2480 wrote to memory of 2204	2480	rundll32.exe	29
PID 2480 wrote to memory of 2204	2480	rundll32.exe	29
PID 2480 wrote to memory of 2204	2480	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\core.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\core.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2480
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 232
    3⤵
    - Program crash
    PID:2204

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads