6acad13221b8e15e7d5bcd3f3705c8da7751550bc6e6bf42fc23d17d0eda1a50 | Triage

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-06-2024 22:45

Sharing

Report Analysis Logs

General

Target

yrcvb.dll
Size

11KB
MD5

8d80a618809cc8ce5970b0839f0e2b5a
SHA1

34af09ca5aa646debe4d2bd06fd5b3c3b7a43b09
SHA256

f4163107f632e0b431c38652eb297733f4f01d37576100673a47370da9221159
SHA512

21bfab7002044c7b33d99de355b49357ae5c45c8781ae080a906c091621ab55e39444e3ecfe04345022ab214dd50f38df0387a3386e0442312cc614bc8b397bf
SSDEEP

192:s6/In3h0bUe1nJBmKESoXIIbzuStOiKazVWGUwkcU:s6ax0B1nJBbxojuStORazsV

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
3948	5068	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

rundll32.exe

pid	Process
5068	rundll32.exe
5068	rundll32.exe
5068	rundll32.exe
5068	rundll32.exe
5068	rundll32.exe
5068	rundll32.exe
5068	rundll32.exe
5068	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 1100 wrote to memory of 5068	1100	rundll32.exe	81
PID 1100 wrote to memory of 5068	1100	rundll32.exe	81
PID 1100 wrote to memory of 5068	1100	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\yrcvb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\yrcvb.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5068
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5068 -s 672
    3⤵
    - Program crash
    PID:3948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 5068 -ip 5068
1⤵
PID:4916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5068-0-0x0000000010000000-0x0000000010006000-memory.dmp

Filesize
24KB

Download
memory/5068-1-0x0000000010000000-0x0000000010006000-memory.dmp

Filesize
24KB

Download