da96ab9066c82c4c0350c25d4dc0486472c9ab620dc353768ed31846bef60dd7 | Triage

Analysis

max time kernel
92s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 11:17

Sharing

Report Analysis Logs

General

Target

$SYSDIR/lame_enc.dll
Size

232KB
MD5

aced3cc66b2940055763837783597c81
SHA1

47c2fd4e5666ec463c3a1b035f44ffe54ed596af
SHA256

54ec306be159a8626f5b80350a3ef2d950f72b85d068bd1db3abf03a04109de0
SHA512

6e107bdb6ef20064fc825191db2f96a9434ceeb30d6a4f9bf54308cac28a324752a7a36e9ca2cb520a5615ef0ff7cc15ee49383bc17a48bf0761b4c5097978d3
SSDEEP

6144:/ntXY/ZE8glYQz0bkDCgdXug4amHUaaZZZZZYRcNj:/ntCZdg2Vb2d/7aXamc

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3820	1312	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 1312	1936	rundll32.exe	82
PID 1936 wrote to memory of 1312	1936	rundll32.exe	82
PID 1936 wrote to memory of 1312	1936	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\lame_enc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\lame_enc.dll,#1
  2⤵
  PID:1312
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1312 -s 600
    3⤵
    - Program crash
    PID:3820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1312 -ip 1312
1⤵
PID:4284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads