12978eef9daed92259dc10c461bdf027cc646b49425f9941da73d4ded1483d86 | Triage

Analysis

max time kernel
147s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 20:18

Sharing

Report Analysis Logs

General

Target

DuiLib_u.dll
Size

425KB
MD5

58afc94e30f77281aeccbc3908b56729
SHA1

6101614afcc975212ba8f5c110cca13909c06949
SHA256

af62011d1e8442102020db94518eb2a97e6c90db01009c500ca5e9a9fc6e7b44
SHA512

0a6e420d97be685ccddca3aaa503fa91625df6453a8c8aec046c69651d35dc10d8b0074cbe042f0ccadf4d24b3676e91622bf85ad757c6c0767a841b65bed717
SSDEEP

6144:6FIvKBO6G6CNREaw9wZW/gRHG3OcxW+MhOn67rf7tDG:6FCKBmVAb/g7cc5hxG

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2700	1668	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 1668	4796	rundll32.exe	82
PID 4796 wrote to memory of 1668	4796	rundll32.exe	82
PID 4796 wrote to memory of 1668	4796	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DuiLib_u.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DuiLib_u.dll,#1
  2⤵
  PID:1668
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 640
    3⤵
    - Program crash
    PID:2700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1668 -ip 1668
1⤵
PID:2728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads