ffc673f964fb067cdbb7998e307f8811e6cc161392dccf6273d03cadfb4e7917 | Triage

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 17:44

Sharing

Report Analysis Logs

General

Target

core.dll
Size

56KB
MD5

9888f4f608d1fbd5cb440fd12ac846c6
SHA1

6e9d68202df8a8a1ef23d7b626e28a92d4cba11b
SHA256

678df0973f3132e65345aa4443c27ad9d59c10997cfe96489725d4659532974a
SHA512

6189e53d19ae7266cc76782a5dd235547a9e4b9cf469d0d21056882e00cb824df5744f92c9ade98ff3e7f24de7b56675f90b9a85043511dcd6ec04a16ba8cf51
SSDEEP

768:VprFS20OyoOjhEROHiyJVbDMVkqEA5hSo0nC/eFD:VpI20O/OuOCyJV8GqEA5enC/ID

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2836	5044	WerFault.exe	91

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 5044	4588	rundll32.exe	91
PID 4588 wrote to memory of 5044	4588	rundll32.exe	91
PID 4588 wrote to memory of 5044	4588	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\core.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\core.dll,#1
  2⤵
  PID:5044
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 616
    3⤵
    - Program crash
    PID:2836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5044 -ip 5044
1⤵
PID:1064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4440,i,16710585221322798697,8586257254049248207,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:8
1⤵
PID:3504

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads