Analysis
-
max time kernel
91s -
max time network
94s -
platform
windows11-21h2_x64 -
resource
win11-20240611-en -
resource tags
-
submitted
19-06-2024 12:51
General
-
Target
KRNLWRD/krnl.dll
-
Size
5.3MB
-
MD5
e9921b7d3ff7044834e0c5998270cd0c
-
SHA1
e30c5794dbc92578d5bbd23d095a4a256caf4912
-
SHA256
c0e5c51445b189f8a17529ce8fce8d11ed7f99211e19684228fdd12366c458ab
-
SHA512
8a9a83050fee7084caa606f5e26018d4ce4b0a7a10e481fcdd8b1eae6c7b459dbe633b5b4b03b91d49427481f9e03880a64418a7e52ad6c06d25de98692a028e
-
SSDEEP
98304:QsK42Kx51uNmHTgZk74mqBjqSQWJuR7iGsMPD4nBx1GyePSByA5Pzm:Iwr154XBJQWaKSsnBv6a5Pz
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\KRNLWRD\krnl.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\KRNLWRD\krnl.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1300 -s 6163⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1300 -ip 13001⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13.4MB
-
Filesize
2.1MB
-
Filesize
4KB
-
Filesize
13.4MB
-
Filesize
13.4MB
-
Filesize
13.4MB
-
Filesize
13.4MB
-
Filesize
2.1MB
-
Filesize
13.4MB