ca2b787bb72f0bd9d79013aa93800bfd84c73aad74662c48e69425e4adfb549b | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
14-06-2024 01:57

Sharing

Report Analysis Logs

General

Target

iepdf32.dll
Size

4.3MB
MD5

f3f6876d132eb277842e31ddc42aa7fa
SHA1

9c167a2854ed106b74dff55a30bdefc55b140e9a
SHA256

4ba2ddde8a4549d08bfe4441643aa626e84d7653b8ddc6ed61823e78aeb3cdf1
SHA512

38b86c745945b0f97461542f89b2570210ddc3fcfeabfe2243a3b861dd80be6641e4b4181956d73926b7926d7c460db8a908ccb912c5209003ee24427aa135f9
SSDEEP

98304:lszKnK7RZKZk8AZ1uWhgTsOTbUW5gmTKuCIUePaFownQCICDQ9:dRZkB1WPgmXPa+CICDA

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2068 2092 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2080 wrote to memory of 2092	2080	rundll32.exe	rundll32.exe
PID 2080 wrote to memory of 2092	2080	rundll32.exe	rundll32.exe
PID 2080 wrote to memory of 2092	2080	rundll32.exe	rundll32.exe
PID 2080 wrote to memory of 2092	2080	rundll32.exe	rundll32.exe
PID 2080 wrote to memory of 2092	2080	rundll32.exe	rundll32.exe
PID 2080 wrote to memory of 2092	2080	rundll32.exe	rundll32.exe
PID 2080 wrote to memory of 2092	2080	rundll32.exe	rundll32.exe
PID 2092 wrote to memory of 2068	2092	rundll32.exe	WerFault.exe
PID 2092 wrote to memory of 2068	2092	rundll32.exe	WerFault.exe
PID 2092 wrote to memory of 2068	2092	rundll32.exe	WerFault.exe
PID 2092 wrote to memory of 2068	2092	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\iepdf32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2080

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\iepdf32.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2092 -s 220
3⤵
- Program crash
PID:2068

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...