c7164a6cf3cb8b7219ecdf48e07968515829790b7f6273d004c5c0ee168f67f9 | Triage

Resubmissions

24/06/2024, 22:28

240624-2dr32sycjk 7

24/06/2024, 22:21

240624-196qmsxhrk 7

Analysis

max time kernel
138s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 22:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

$TEMP/R2RKORGKG.dll
Size

263KB
MD5

6321ff7e66a454c311d4d555b17f8567
SHA1

879fe8e563b4b7f471702c2ffc612851d8804145
SHA256

3a695de76d98f3ccc0b99475eaeff587c5d44dc8836de43a5fa73b1bf65a1ca2
SHA512

5a1c9a7e5786b62593afbeb27c628055fdd1d5930a126feb4886bbbc2a5e5d8e5031842fb14e0a0584a4885d286b8ff18c30e2d0c9e7f5988bafaf13410f1654
SSDEEP

6144:R3HbCkzvTPDVJzfZFTa8hfVwJ2CTLTBExfVNH:lHOg7P5JzxJ84yLT2JVNH

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2652	3076	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 3076	1752	rundll32.exe	82
PID 1752 wrote to memory of 3076	1752	rundll32.exe	82
PID 1752 wrote to memory of 3076	1752	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\R2RKORGKG.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\R2RKORGKG.dll,#1
  2⤵
  PID:3076
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3076 -s 620
    3⤵
    - Program crash
    PID:2652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3076 -ip 3076
1⤵
PID:1820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads