ffc673f964fb067cdbb7998e307f8811e6cc161392dccf6273d03cadfb4e7917 | Triage

Analysis

max time kernel
146s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11-06-2024 17:44

Sharing

Report Analysis Logs

General

Target

crash.dll
Size

88KB
MD5

569f0737f7c397c64ac97b0c5867caee
SHA1

571cd81dc71cd7fb08843df7865bd447017ddebc
SHA256

61264f22f15d8fc81395f8d5b02cd14b1f9fe4729677bc5649f9515951ea0fd6
SHA512

e5d51d0b00fe12ceca5b269b1cf82074c10012cd3a811a968bbc04bb0c99fc96ec896fd1698b5156996f42a954a7d0edc60f8e3328a4eb14c8a08a7c12a9732f
SSDEEP

1536:LMoVm4jFmop00m7WR6VTTQcSEB1I5BoLbwGjrbXsb4DAv:LMoVdmoQ7WwFQjFUVrjsEDAv

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32_crash.log	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 2936	2684	rundll32.exe	82
PID 2684 wrote to memory of 2936	2684	rundll32.exe	82
PID 2684 wrote to memory of 2936	2684	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\crash.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\crash.dll,#1
  2⤵
  - Drops file in System32 directory
  PID:2936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2936-0-0x0000000000CA0000-0x0000000000CAF000-memory.dmp

Filesize
60KB

Download