625fba7fa29e9eb30a9cc98ece69706cbd66792b4185f92e14363657bd0e76d5 | Triage

Analysis

max time kernel
93s
max time network
202s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20-06-2024 08:57

Sharing

Report Analysis Logs

General

Target

http_dll.dll
Size

20KB
MD5

cc496b5bf0fe335447d1c08eb84ad8ab
SHA1

11ada1737b52fac71138160f8ff14d23819308e7
SHA256

f8b107ba060fc57899e02b6b5117c2603e169d8ee4beddf53be6d453e4fc12fb
SHA512

361e830fd956eaf26d49bba92118a1e1d717cf0169f8def9989a813d123655bda9a45fa09d0ac4a34165d76ce4f279ea50ef35b0d6a5303881e4b0b42c972019
SSDEEP

48:qAWig/W3oBaPDhFEj4R4L4DWBO51ltm8Ue7ocmRiUH4+ft2MaVVRVCk:kvcL3PR48Dv1lo8Ue8cYiUhVaVVRVCk

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4484	5052	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 5052	5080	rundll32.exe	81
PID 5080 wrote to memory of 5052	5080	rundll32.exe	81
PID 5080 wrote to memory of 5052	5080	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\http_dll.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\http_dll.dll,#1
  2⤵
  PID:5052
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 556
    3⤵
    - Program crash
    PID:4484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5052 -ip 5052
1⤵
PID:416

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads